# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.20-5
changelog:
  - Bump version to 1.4.3.30-5
  - Resolves: Bug 2113002 - ipa-replica-manage --connect --winsync fails with traceback


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.30-6
changelog:
  - Bump version to 1.4.3.30-6
  - Resolves: Bug 2113002 - ipa-replica-manage --connect --winsync fails with traceback
  - Resolves: Bug 2118763 - SIGSEGV in sync_repl


author: Mark Reynolds <mreynolds@rehdat.com> - 1.4.3.34-1
changelog:
  - Bump version to 1.4.3.34-1
  - Resolves: Bug 2177234 - pam mutex lock causing high etimes, affecting red hat internal sso


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.39.6-1
changelog:
  - Update to 1.39.6 release (development)
  - Implement ACD (address conflict detection) for DHCPv4 (rh #1713380)


author: Lubomir Rintel <lkundrak@v3.sk> - 1:1.39.7-1
changelog:
  - Update to 1.39.7 release (development)
  - core: cancel the IP check on deactivation (rh #2080928)
  - core: ensure DHCP is restarted every time the link goes up (rh #2079406)
  - core: fix a leak of L3 configuration memory (rh #2083453)
  - ppp: fix a race with pppd when removing addresses (rh #2085382)
  - wifi: fix a crash when checking WEP supplicant capability (rh #2092782)


author: Lubomir Rintel <lkundrak@v3.sk> - 1:1.39.8-1
changelog:
  - Update to 1.39.8 release (development)
  - core: make ipv6.addr-gen-mode default configurable (rh #1743161) (rh #2082682)
  - dhcpv6: finish DAD before considering a lease to be good (rh #2096386)
  - core: add connection.wait-activation-delay property (rh #2008337)


author: Vojtech Bubela <vbubela@redhat.com> - 1:1.39.10-1
changelog:
  - Update to 1.39.10 release (development)
  - initrd: set a default carrier timeout of 10 seconds in initrd (rh #2079277)
  - dhcp: wait DAD completion for DHCPv6 addresses (rh #2096386)
  - libnm: support wait-activation-delay property (rh #2008337)
  - veth: fix veth activation on booting (rh #2105956)
  - support a ipv6.addr-gen-mode knob in the global config (rh #208268)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.39.11-1
changelog:
  - Update to 1.39.11 release (development)
  - dhcp: fix EXTENDED DHCP event to accept lease for dhclient plugin (rh #2109285)
  - ovs: honor unmanaged setting also for interfaces that fail (rh #2077950)


author: Ana Cabral <acabral@redhat.com> - 1:1.39.90-1
changelog:
  - Update to 1.39.90 release (release candidate)
  - bridge: fix reapply of non-bridge properties (rh #2092762)
  - bridge: fix wired.mtu reapply (rh #2076131)


author: Fernando Fernandez Mancera <ferferna@redhat.com> 1:1.40.0-5
changelog:
  - ovs: wait that links disappear during initial cleanup (rh #2153429)
  - core: wait for carrier before resolving hostname via DNS (rh #2152891)


author: Jindrich Novy <jnovy@redhat.com> - 2:1.1.0-5
changelog:
  - fix "Two aardvark-dns instances trying to use the same port
    on the same interface"
  - Resolves: #2130234


author: Dimitri Savineau <dsavinea@redhat.com> - 2.13.1-1
changelog:
  - ansible-core 2.13.1 release (rhbz#2103699)
  - add bundled version of jinja2, markupsafe and resolvelib
  - rebuild with python 3.9


author: Thomas Woerner <twoerner@redhat.com> - 1.5.3-1
changelog:
  - Update to version 1.5.3
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.5.3
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.5.2
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.5.1
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.5.0
    Related: RHBZ#2010621
  - automember set default group/hostgroup is missing from the automember module
    Resolves: RHBZ#1999912
  - automember remove default group/hostgroup is missing from the automember
    module
    Resolves: RHBZ#1999913
  - automember rebuild is missing from the automember module
    Resolves: RHBZ#1999915
  - automember remove orphans group/hostgroup is missing from the automember
    module
    Resolves: RHBZ#1999916
  - Not able to update existing automember rule description
    Resolves: RHBZ#2021393


author: Thomas Woerner <twoerner@redhat.com> - 1.6.1-1
changelog:
  - Update to version 1.6.1
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.6.1
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.6.0
    Related: RHBZ#2010621
  - Add module to manage automount maps
    Resolves: RHBZ#2040462
  - Add module to manage automount keys
    Resolves: RHBZ#2040464
  - Client deploy failing with ipaadmin keytab and OTP due to latest ansible
    version
    Resolves: RHBZ#2041753


author: Thomas Woerner <twoerner@redhat.com> - 1.6.2-1
changelog:
  - Update to version 1.6.2
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.6.2
    Related: RHBZ#2010621


author: Thomas Woerner <twoerner@redhat.com> - 1.6.3-1
changelog:
  - Update to version 1.6.3
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.6.3
    Related: RHBZ#2010621


author: Thomas Woerner <twoerner@redhat.com> - 1.7.0-1
changelog:
  - Update to version 1.7.0
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.7.0
    Resolves: RHBZ#2080321
  - New idrange management module.
    Resolves: RHBZ#1921545
  - Not able to update empty descriptions in automount maps.a
    Resolves: RHBZ#2048552
  - New servicedelegationrule management module.
    Resolves: RHBZ#2069170
  - New servicedelegationtarget management module.
    Resolves: RHBZ#2069172
  - Add support for managing idoverrideusers in ipagroup.
    Resolves: RHBZ#2069173


author: Thomas Woerner <twoerner@redhat.com> - 1.8.0-1
changelog:
  - idrange: Fix usage of dom_name when idrange doesn't exist.
    Resolves: RHBZ#2086993
  - smartcard roles for ansible-freeipa
    Resolves: RHBZ#2076554


author: Thomas Woerner <twoerner@redhat.com> - 1.8.1-1
changelog:
  - Update to version 1.8.1
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.8.1
    Related: RHBZ#2080321
  - ipa server deploys failing with latest IPA compose
    Resolves: RHBZ#2103928
  - ipaserver_external_cert_files failes to copy with ansible 2.13
    Resolves: RHBZ#2104842


author: Thomas Woerner <twoerner@redhat.com> - 1.8.2-1
changelog:
  - Update to version 1.8.2
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.8.2
    Related: RHBZ#2080321
  - SIDs are always generated for server and replica deployments
    Resolves: RHBZ#2110491
  - Random Serial Numbers are not enabled by default any more
    Resolves: RHBZ#2110526
  - Fixes comparison of bool values in IPA 4.9.10+ for ipadnsconfig
    Resolves: RHBZ#2110539


author: Thomas Woerner <twoerner@redhat.com> - 1.8.3-1
changelog:
  - Update to version 1.8.3
    https://github.com/freeipa/ansible-freeipa/releases/tag/v1.8.3
    Related: RHBZ#2080321
  - Fixes replica deployment issue for domains without SID support.
    Related: RHBZ#2110491


author: Thomas Woerner <twoerner@redhat.com> - 1.8.3-2
changelog:
  - ipaserver: Add missing idstart check
    Resolves: RHBZ#2132974
  - Replica Install Setup DNS fails
    Resolves: RHBZ#2132988
  - ipaconfig: Add support for SID related attributes
    Resolves: RHBZ#2132994
  - paconfig: Fix fail_json calls
    Resolves: RHBZ#2135753
  - ipaconfig: Do not allow enable_sid set to False
    Resolves: RHBZ#2135754
  - ipaconfig: Do not require enable_sid for add_sids or netbios_name
    Resolves: RHBZ#2135775


author: Jakub Hrozek <jhrozek@redhat.com> - 1.0-13
changelog:
  - Revert pam_systemd.so to be optional
  - Resolves: #rhbz1643928 - pam_systemd shouldn't be optional in system-auth


author: Pavel Březina <pbrezina@redhat.com> - 1.1-1
changelog:
  - Rebase to authselect-1.1 (RHBZ #1685516)
  - Notify that oddjob-mkhomedir needs to be enabled manually (RHBZ #1694103)
  - Ask for smartcard insertion when smartcard authentication is required (RHBZ #1674397)
  - Update translations (RHBZ #1689973)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.1-1
changelog:
  - Rebase to authselect-1.2.1 (RHBZ #1810471)
  - CLI commands are now correctly translated (RHBZ #1816009)
  - Remove unsupported features from sssd profile description (RHBZ #1830251)
  - add `with-files-access-provider` to sssd profile (RHBZ #1734094)
  - switch to pam_usertype module (RHBZ #1773567)
  - fix typo in sssd profile description (RHBZ #1787638)
  - add minimal profile (RHBZ #1654018)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.2-2
changelog:
  - try_first_pass option no longer works on some PAM modules in RHEL8 (RHBZ #1949070)
  - Need to localize the description of --debug option in authselect show (RHBZ #1970408)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.5-1
changelog:
  - Rebase to 1.2.5 (RHBZ #2080238)
  - sssd profile with-smartcard no longer prevents local users from accessing cron (RHBZ #2070325)
  - backup-restore now works correctly (RHBZ #2066535)
  - add with-subid to sssd profile (RHBZ #2063750)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-4
changelog:
  - Tighten cache protection against record from forwarders (CVE-2021-25220)
  - Include test of forwarders


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-5
changelog:
  - Fix memory leak in ECDSA verify processing (CVE-2022-38177)
  - Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: Thomas Woerner <twoerner@redhat.com> - 11.2-2
changelog:
  - Add support for serve-stale, detected on build time
    Patch by Petr Menšík <pemensik@redhat.com>
    Related: RHBZ#1762813


author: Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.9.1
changelog:
  - Fix possible serve-stale related crash (CVE-2022-3080)
  - Fix memory leak in ECDSA verify processing (CVE-2022-38177)
  - Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-3
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/9dd415b)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-4
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/e5384ed)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-5
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/dcd385e)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.6-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/7aedb16)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.9-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/c1d6200)
  - fixes CVE-2021-3602
  - Related: #1977943


author: Jindrich Novy <jnovy@redhat.com> - 1.19.9-2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/ff5434f)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1.19.9-3
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/3808e27)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1.19.9-4
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/7c6701d)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1.19.9-5
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/d69ac6e)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1.19.9-6
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/6d7f496)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1:1.27.2-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.27
    (https://github.com/containers/buildah/commit/13622b1)
  - Resolves: #2129767


author: Jindrich Novy <jnovy@redhat.com> - 1:1.27.2-2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.27
    (https://github.com/containers/buildah/commit/c43a389)
  - Resolves: #2136438


author: Jindrich Novy <jnovy@redhat.com> - 1:1.27.2-3
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.27
    (https://github.com/containers/buildah/commit/5b86d15)
  - Resolves: #2150428


author: Jindrich Novy <jnovy@redhat.com> - 1:1.27.3-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.27
    (https://github.com/containers/buildah/commit/4785fdb)
  - Resolves: #2152017


author: Jon Maloy <jmaloy@redhat.com> - 21.1-13
changelog:
  - ci-Add-flexibility-to-IMDS-api-version-793.patch [bz#2023940]
  - ci-Azure-helper-Ensure-Azure-http-handler-sleeps-betwee.patch [bz#2023940]
  - ci-azure-Removing-ability-to-invoke-walinuxagent-799.patch [bz#2023940]
  - ci-Azure-eject-the-provisioning-iso-before-reporting-re.patch [bz#2023940]
  - ci-Azure-Retrieve-username-and-hostname-from-IMDS-865.patch [bz#2023940]
  - ci-Azure-Retry-net-metadata-during-nic-attach-for-non-t.patch [bz#2023940]
  - ci-Azure-adding-support-for-consuming-userdata-from-IMD.patch [bz#2023940]
  - Resolves: bz#2023940
    ([RHEL-8] Support for provisioning Azure VM with userdata)


author: Jon Maloy <jmaloy@redhat.com> - 21.1-14
changelog:
  - ci-Fix-IPv6-netmask-format-for-sysconfig-1215.patch [bz#2046540]
  - Resolves: bz#2046540
    (cloud-init writes route6-$DEVICE config with a HEX netmask. ip route does not like : Error: inet6 prefix is expected rather than "fd00:fd00:fd00::/ffff:ffff:ffff:ffff::".)


author: Camilla Conte <cconte@redhat.com> - 21.1-15
changelog:
  - ci-Detect-a-Python-version-change-and-clear-the-cache-8.patch [bz#1935826]
  - ci-Fix-MIME-policy-failure-on-python-version-upgrade-93.patch [bz#1935826]


author: Jon Maloy <jmaloy@redhat.com> - 22.1-2
changelog:
  - ci-Add-native-NetworkManager-support-1224.patch [bz#2059872]
  - ci-Use-Network-Manager-and-Netplan-as-default-renderers.patch [bz#2059872]
  - ci-Align-rhel-custom-files-with-upstream-1431.patch [bz#2082071]
  - ci-Remove-rhel-specific-files.patch [bz#2082071]
  - Resolves: bz#2059872
    ([RHEL-8]Rebase cloud-init from Fedora so it can configure networking using NM keyfiles)
  - Resolves: bz#2082071
    (Align cloud.cfg file and systemd with cloud-init upstream .tmpl files)


author: Jon Maloy <jmaloy@redhat.com> - 22.1-3
changelog:
  - ci-Support-EC2-tags-in-instance-metadata-1309.patch [bz#2082686]
  - Resolves: bz#2082686
    ([cloud][init] Add support for reading tags from instance metadata)


author: Miroslav Rezanina <mrezanin@redhat.com> - 22.1-4
changelog:
  - ci-cloud-init.spec-adjust-path-for-66-azure-ephemeral.r.patch [bz#2096269]
  - ci-setup.py-adjust-udev-rules-default-path-1513.patch [bz#2096269]
  - Resolves: bz#2096269
    (Adjust udev/rules default path[RHEL-8])


author: Jon Maloy <jmaloy@redhat.com> - 22.1-5
changelog:
  - ci-Revert-Add-native-NetworkManager-support-1224.patch [bz#2107464 bz#2110066 bz#2117526 bz#2104393 bz#2098624]
  - ci-Revert-Use-Network-Manager-and-Netplan-as-default-re.patch [bz#2107464 bz#2110066 bz#2117526 bz#2104393 bz#2098624]
  - Resolves: bz#2107464
    ([RHEL-8.7] Cannot run sysconfig when changing the priority of network renderers)
  - Resolves: bz#2110066
    (DNS integration with OpenStack/cloud-init/NetworkManager is not working)
  - Resolves: bz#2117526
    ([RHEL8.7] Revert patch of configuring networking by NM keyfiles)
  - Resolves: bz#2104393
    ([RHEL-8.7]Failed to config static IP and IPv6 according to VMware Customization Config File)
  - Resolves: bz#2098624
    ([RHEL-8.7] IPv6 not workable when cloud-init configure network using NM keyfiles)


author: Camilla Conte <cconte@redhat.com> - 22.1-6.el8_7
changelog:
  - ci-Ensure-network-ready-before-cloud-init-service-runs-.patch [bz#2153182]
  - Resolves: bz#2153182
    ([RHEL-8] Ensure network ready before cloud-init service runs on RHEL [rhel-8.7.0.z])


author: Jon Maloy <jmaloy@redhat.com> - 22.1-6.el8_7.2
changelog:
  - ci-cc_set_hostname-ignore-var-lib-cloud-data-set-hostna.patch [bz#2165945]
  - Resolves: bz#2165945
    (systemd[1]: Failed to start Initial cloud-init job after reboot system via sysrq 'b' [RHEL-8] [rhel-8.7.0.z])


author: Jindrich Novy <jnovy@redhat.com> - 27.1-3
changelog:
  - another gating test fix - don't remove all containers but only admin ones
    thanks to Matej Marusak
  - Related: #1883490


author: Marek Polacek <polacek@redhat.com> 10.2.1-1
changelog:
  - GCC 10.2 release
  - disable -flto in %{optflags}, lto bootstrap will be enabled the GCC way
    later
  - require MPFR Library version 3.1.0 (or later)


author: Jindrich Novy <jnovy@redhat.com> - 2:2.1.2-2
changelog:
  - update to latest content of https://github.com/containers/conmon/releases/tag/2.1.2
    (https://github.com/containers/conmon/commit/2bc95ee697e87d5f7b77063cf83fc32739addafe)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.177.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.177.0
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 2:2.178.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.178.0
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 2:2.180.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.180.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.181.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.181.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.183.0-1
changelog:
  - update to
    https://github.com/containers/container-selinux/releases/tag/v2.183.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.187.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.187.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.188.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.188.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.189.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.189.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:2.176.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.176.0
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 2:2.179.1-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.179.1
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 2:2.183.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.183.0
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 0.8.6-2
changelog:
  - propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0.1-2
changelog:
  - revert back to https://github.com/containernetworking/plugins/releases/tag/v1.0.1
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 2:1-36
changelog:
  - remove aardvark-dns and netavark - packaged separately
  - update vendored components and configuration files
  - Related: #2061390


author: Jan Friesse <jfriesse@redhat.com> 3.0.0-4
changelog:
  - Resolves: rhbz#1827256

  - Add explicit corosync-qdevice and corosync-qnetd dependency for revdeps CI test


author: Jan Friesse <jfriesse@redhat.com> - 3.0.1-1.1
changelog:
  - Resolves: rhbz#2180246

  - qdevice: Destroy non blocking client on failure (rhbz#2180246)
  - merge upstream commit 4331c7d5650a8bf44c16512419f1954d0ef96df5 (rhbz#2180246)


author: Adrian Reber <adrian@lisas.de> - 3.12-0.1
changelog:
  - Updated to 3.12 (pre-release)
  - Create libs subpackage
  - Build against SELinux (Fedora and RHEL8)
  - Build against libbsd (Fedora)


author: Jindrich Novy <jnovy@redhat.com> - 3.15-3
changelog:
  - add Requires: criu-libs = %{version}-%{release} in criu-devel
  - add gating tests
  - Related: #1934415


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-18
changelog:
  - http: send payload when (proxy) authentication is done (#1918692)
  - curl: Inferior OCSP verification (CVE-2020-8286)
  - libcurl: FTP wildcard stack overflow (CVE-2020-8285)
  - curl: trusting FTP PASV responses (CVE-2020-8284)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-19
changelog:
  - make `curl --head file://` work as expected (#1947493)
  - prevent automatic referer from leaking credentials (CVE-2021-22876)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-21
changelog:
  - fix TELNET stack contents disclosure again (CVE-2021-22925)
  - fix TELNET stack contents disclosure (CVE-2021-22898)
  - fix bad connection reuse due to flawed path name checks (CVE-2021-22924)
  - disable metalink support to fix the following vulnerabilities
      CVE-2021-22923 - metalink download sends credentials
      CVE-2021-22922 - wrong content via metalink not discarded


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-22
changelog:
  - fix STARTTLS protocol injection via MITM (CVE-2021-22947)
  - fix protocol downgrade required TLS bypass (CVE-2021-22946)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-23
changelog:
  - fix credential leak on redirect (CVE-2022-27774)
  - fix auth/cookie leak on redirect (CVE-2022-27776)
  - fix OAUTH2 bearer bypass in connection re-use (CVE-2022-22576)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-24
changelog:
  - fix too eager reuse of TLS and SSH connections (CVE-2022-27782)
  - fix invalid type in printf() argument detected by Coverity


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-25
changelog:
  - setopt: enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION (#2063703)
  - fix HTTP compression denial of service (CVE-2022-32206)
  - fix FTP-KRB bad message verification (CVE-2022-32208)


author: Ray Strode <rstrode@redhat.com> - 1:1.12.8-22
changelog:
  - Use hangup signal instead of termination signal to
    kill sesssion monitoring script to appeach tcsh.
    Related: #2089362


author: Ray Strode <rstrode@redhat.com> - 1:1.12.8-23
changelog:
  - Address race for very short running sessions in SSH
    session monitoring script.
    Related: #2089362


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-20
changelog:
  - Add 0079-libmultipath-use-typedef-for-keyword-handler-and-pri.patch
  - Add 0080-libmultipath-print-the-correct-file-when-parsing-fai.patch
  - Add 0081-libmultipath-pass-file-and-line-number-to-keyword-ha.patch
  - Add 0082-libmultipath-make-set_int-take-a-range-for-valid-val.patch
  - Add 0083-libmultipath-improve-checks-for-set_str.patch
  - Add 0084-libmultipath-split-set_int-to-enable-reuse.patch
  - Add 0085-libmultipath-cleanup-invalid-config-handling.patch
  - Add 0086-libmultipath-don-t-return-error-on-invalid-values.patch
    * Above 8 patches fix bz #1900595
  - Add 0087-multipathd-avoid-unnecessary-path-read-only-reloads.patch
    * Fixes bz #2009624
  - Resolves: bz #1900595, #2009624, #2021823


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-21
changelog:
  - Add 0088-libmultipath-make-helper-function-to-trigger-path-ue.patch
  - Add 0089-multipathd-trigger-udev-change-on-path-addition.patch
  - Resolves: bz #1862032


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-23
changelog:
  - Add 0091-multipath-tools-add-HPE-MSA-1060-2060-to-hwtable.patch
    * Partial fix for bz #2058222
  - Add 0092-multipath-tools-update-mpp-force_readonly-in-ev_add_.patch
    * Fixes bz #2065468
  - Add 0093-updated-HPE-MSA-builtin-config.patch
    * Fixes bz #2058222
  - Resolves bz #2065468, #2058222


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-24
changelog:
  - Add 0094-multipath-return-failure-on-an-invalid-remove-comman.patch
    * Fixes bz #2052054
  - Add 0095-libmultipath-steal-the-src-string-pointer-in-merge_s.patch
  - Add 0096-libmultipath-enable-linear-ordering-of-bus-proto-tup.patch
  - Add 0097-libmultipath-use-bus_protocol_id-in-snprint_path_pro.patch
  - Add 0098-libmultipath-make-protocol_name-global.patch
  - Add 0099-libmultipath-add-a-protocol-subsection-to-multipath..patch
  - Add 0100-libmultipath-Set-the-scsi-timeout-parameters-by-path.patch
  - Add 0101-libmultipath-check-the-overrides-pctable-for-path-va.patch
  - Add 0102-libmultipath-fix-eh_deadline-documentation.patch
  - Add 0103-libmultipath-Add-documentation-for-the-protocol-subs.patch
  - Add 0104-libmultipath-use-symbolic-value-for-invalid-pcentry.patch
    * The above 10 patches implement feature from bz #2065477
  - Resolves: bz #2052054, #2065477


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-25
changelog:
  - Add 0105-multipathd-handle-fpin-events.patch
  - Add 0106-multipathd-disallow-changing-to-from-fpin-marginal-p.patch
  - Resolves: bz #2083077


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-27
changelog:
  - Add 0108-multipathd-Add-missing-ctype-include.patch
  - Add 0109-multipathd-replace-libreadline-with-libedit.patch
    * replace readline with libedit, to avoid license conflicts
  - Resolves: bz #2119887


author: Petr Menšík <pemensik@redhat.com> - 2.79-24.1
changelog:
  - Avoid DHCPv6 relayed replies with Client Link-Layer Address (#2169355)
  - Use upstream change for CVE-2022-0934 (#2164859)


author: Omair Majid <omajid@redhat.com> - 3.1.416-4
changelog:
  - Update to .NET SDK 3.1.416 and Runtime 3.1.22
  - Resolves: RHBZ#2011820
  - Resolves: RHBZ#2003077
  - Resolves: RHBZ#2031428


author: Timothy Redaelli <tredaelli@redhat.com> - 19.11.1-1
changelog:
  - Rebase DPDK to 19.11.1 (#1824905)
  - Remove dpdk-pmdinfo.py (#1801361)
  - Add Requires: rdma-core-devel libmnl-devel on x86_64 for dpdk-devel (#1813252)


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-5
changelog:
  - Fix multiple CVEs
  - CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
  - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
  - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
  - CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
  - CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
  - CVE-2022-22825 Integer overflow in lookup in xmlparse.c
  - CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
  - CVE-2022-22823 Integer overflow in build_model in xmlparse.c
  - CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
  - Resolves: CVE-2022-23852
  - Resolves: CVE-2021-45960
  - Resolves: CVE-2021-46143
  - Resolves: CVE-2022-22827
  - Resolves: CVE-2022-22826
  - Resolves: CVE-2022-22825
  - Resolves: CVE-2022-22824
  - Resolves: CVE-2022-22823
  - Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-6
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-10.1
changelog:
  - CVE-2022-43680 expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate
  - Resolves: CVE-2022-43680


author: Radovan Sroka <rsroka@redhat.com> - 0.9.1-3
changelog:
  RHEL 8.2 ERRATUM
  - fixed build time python interpreter detection (spec)
  - added python2-devel as a BuildRequires (spec)
  - allow running bash scripts in home directories
  Resolves: rhbz#1801872


author: Radovan Sroka <rsroka@redhat.com> - 1.0-2
changelog:
  RHEL 8.3 ERRATUM
  - rebase to v1.0
  - installed multiple policies to /usr/share/fapolicyd
    - known-libs (default)
    - restrictive
  - installed fapolicyd.trust file
  - enhanced fapolicyd-cli
  Resolves: rhbz#1817413
  - introduced fapolicyd-selinux that provides SELinux policy module
  Resolves: rhbz#1714529


author: Radovan Sroka <rsroka@redhat.com> - 1.0.2-3
changelog:
  RHEL 8.4.0 ERRATUM
  - rebase to 1.0.2
  - strong dependency on rpm/rpm-plugin-fapolicyd
  - installed dnf-plugin is dummy and we are not using it anymore
  - enabled integrity setting
  Resolves: rhbz#1887451
  - added make check
  - Adding DISA STIG during OS installation causes 'ipa-server-install' to fail
  - fixed java detection
  Resolves: rhbz#1895435
  - dnf update fails when fapolicyd is enabled
  Resolves: rhbz#1876975
  - fapolicyd breaks system upgrade, leaving system in dead state - complete fix
  Resolves: rhbz#1896875


author: Radovan Sroka <rsroka@redhat.com> - 1.0.2-7
changelog:
  - fapolicyd abnormally exits by executing sosreport
  - fixed multiple problems with unlink()
  - fapolicyd breaks system upgrade, leaving system in dead state - complete fix
  Resolves: rhbz#1943251


author: Zoltan Fridrich <zfridric@redhat.com> - 1.0.4-2
changelog:
  RHEL 8.6.0 ERRATUM
  - rebase to 1.0.4
  - added rpm_sha256_only option
  - added trust.d directory
  - allow file names with whitespace in trust files
  - use full paths in trust files
  Resolves: rhbz#1939379
  - fix libc.so getting identified as application/x-executable
  Resolves: rhbz#1989272
  - fix fapolicyd-dnf-plugin reporting as '<invalid>'
  Resolves: rhbz#1997414
  - fix selinux DSP module definition in spec file
  Resolves: rhbz#2014445


author: Radovan Sroka <rsroka@redhat.com> - 1.1-1
changelog:
  RHEL 8.6.0 ERRATUM
  - rebase to 1.1
  Resolves: rhbz#1939379
  - introduce rules.d feature
  Resolves: rhbz#2054741
  - remove pretrans scriptlet
  Resolves: rhbz#2051485


author: Radovan Sroka <rsroka@redhat.com> - 1.1.3-8
changelog:
  RHEL 8.7.0 ERRATUM
  - rebase fapolicyd to the latest stable vesion
  Resolves: rhbz#2100087
  - fapolicyd does not correctly handle SIGHUP
  Resolves: rhbz#2070639
  - fapolicyd often breaks package updates
  Resolves: rhbz#2111243
  - drop libgcrypt in favour of openssl
  Resolves: rhbz#2111935
  - fapolicyd.rules doesn't advertise that using a username/groupname instead of uid/gid also works
  Resolves: rhbz#2103914
  - fapolicyd gets way too easily killed by OOM killer
  Resolves: rhbz#2100089
  - compiled.rules file ownership and mode
  Resolves: rhbz#2066653
  - Faulty handling of static applications
  Resolves: rhbz#2084497
  - Introduce ppid rule attribute
  Resolves: rhbz#2102563
  - CVE-2022-1117 fapolicyd: fapolicyd wrongly prepares ld.so path [rhel-8.7.0]
  Resolves: rhbz#2069121
  - Fapolicyd denies access to /usr/lib64/ld-2.28.so [rhel-8.7.0]
  Resolves: rhbz#2068105


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-94
changelog:
  - fence_ibm_vpc: remove unused instance parameter and make limit
    optional
    Resolves: rhbz#2080994


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-96
changelog:
  - all agents: unify ssl parameters to avoid having to use --ssl when
    using --ssl-secure/--ssl-insecure for some agents
    Resolves: rhbz#2072421


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-99
changelog:
  - fence_ibm_powervs: add support for proxy, private API servers and
    get token via API key
    Resolves: rhbz#2092921


author: Jindrich Novy <jnovy@redhat.com> - 1.1.2-3
changelog:
  - fix "error bind mounting /dev from host into mount namespace"
    (the openat2 syscall is not yet supported by the RHEL8 kernel)
  - Resolves: #1867447


author: Marek Polacek <polacek@redhat.com> 8.5.0-13
changelog:
  - require docbook-style-xsl instead of docbook5-style-xsl (#2073888)
  - backport Default widths with -fdec-format-defaults patch (#2074614)


author: Marek Polacek <polacek@redhat.com> 12.1.1-3
changelog:
  - update from releases/gcc-12 branch
    - PRs c++/49387, c++/102307, c++/102651, c++/104470, c++/105491, c++/105589,
  	c++/105623, c++/105652, c++/105655, c++/105725, c++/105734,
  	c++/105756, c++/105761, c++/105779, c++/105795, c++/105852,
  	c++/105871, c++/105885, c++/105908, c++/105925, c++/105931,
  	c++/105964, c++/106001, c/105635, d/105544, fortran/105230,
  	gcov-profile/105535, ipa/100413, ipa/105600, ipa/105639, ipa/105739,
  	libgomp/105745, libgomp/106045, libstdc++/104731, libstdc++/105284,
  	libstdc++/105671, libstdc++/105681, middle-end/105537,
  	middle-end/105604, middle-end/105711, middle-end/105951,
  	middle-end/105998, middle-end/106030, other/105527,
  	preprocessor/105732, rtl-optimization/105455, rtl-optimization/105559,
  	rtl-optimization/105577, sanitizer/105714, sanitizer/105729,
  	target/101891, target/104871, target/105162, target/105209,
  	target/105292, target/105472, target/105556, target/105599,
  	target/105854, target/105879, target/105953, target/105960,
  	target/105970, target/105981, target/106096, tree-optimization/103116,
  	tree-optimization/105431, tree-optimization/105458,
  	tree-optimization/105528, tree-optimization/105562,
  	tree-optimization/105618, tree-optimization/105726,
  	tree-optimization/105736, tree-optimization/105786,
  	tree-optimization/105940
  - enable tsan and lsan on s390x (#2101610)
  - fix up libtsan on s390x
  - fix nvptx build (PRs bootstrap/105551, target/105938)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.18.1-3
changelog:
  - apply upstream run-command PATH fix (CVE-2018-19486)
  - config: document value 2 for protocol.version (upstream patch)


author: Ondrej Pohorelsky <opohorel@redhat.com> - 2.18.2-1
changelog:
  - Update to release 2.18.2
  - Remote code execution in recursive clones with nested submodules
    Resolves: CVE-2019-1387
  - Fixes CVE-2019-1348, CVE-2019-1349, CVE-2019-1350, CVE-2019-1351,	
    CVE-2019-1352, CVE-2019-1353, CVE-2019-1354


author: Ondřej Pohořelský <opohorel@redhat.com> - 2.31.1-3
changelog:
  - Fixes CVE-2022-23521 and CVE-2022-41903
  - Tests: try harder to find open ports for apache, git, and svn
  - Resolves: #2162063


author: Daiki Ueno <dueno@redhat.com> - 3.6.14-7
changelog:
  - Increase DH key bits to >= 2048 in self-tests (#1879506)
  - Implement self-tests for KDF and CMAC (#1890870)
  - Fix CVE-2020-24659: heap buffer-overflow when "no_renegotiation" alert is received (#1873959)


author: Daiki Ueno <dueno@redhat.com> - 3.6.16-1
changelog:
  - Update to upstream 3.6.16 release (#1956783)
  - Fix potential use-after-free in key_share handling (#1927597)
  - Fix potential use-after-free in pre_shared_key handling (#1927593)
  - Stop gnutls-serv relying on AI_ADDRCONFIG to decide listening address (#1908334)
  - Fix cert expiration issue in tests (#1908110)


author: Zoltan Fridrich <zfridric@redhat.com> - 3.6.16-6
changelog:
  - Fix x86_64 CPU feature detection when AVX is not available (#2131152)
  - Fix timing side-channel in TLS RSA key exchange (#2162598)


author: David Benoit <dbenoit@redhat.com> - 1.17.4-1
changelog:
  - Rebase Go to 1.17.4
  - Add vdso_s390x_gettime patch
  - Add remove_waitgroup_misuse_tests patch
  - Related: rhbz#2014088
  - Resolves: rhbz#2028570
  - Resolves: rhbz#2022828
  - Resolves: rhbz#2024686
  - Resolves: rhbz#2028662


author: David Benoit <dbenoit@redhat.com> - 1.16.7-1
changelog:
  - Rebase to Go 1.16.7
  - Resolves: rhbz#1994079
  - Add reject leading zeros patch
  - Resolves: rhbz#1993314


author: Alejandro Sáez <asm@redhat.com> - 1.18.9-1
changelog:
  - Update to Go 1.18.9
  - Add big-endian.patch
  - Increase GO_TEST_TIMEOUT_SCALE due to a Brew issue
  - Add do-not-reuse-far-trampolines.patch
  - Resolves: rhbz#2149313


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-43
changelog:
  - Related: #2007236 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via
    a crafted request uri-path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-44
changelog:
  - Resolves: #1968278 - CVE-2020-35452 httpd:2.4/httpd: Single zero byte stack
    overflow in mod_auth_digest
  - Resolves: #2001046 - Apache httpd OOME with mod_dav in RHEL 8
  - Resolves: #2005128 (CVE-2021-34798) - CVE-2021-34798 httpd: NULL pointer
    dereference via malformed requests
  - Resolves: #1984828 - mod_proxy_hcheck piles up health checks leading to high
    memory consumption
  - Resolves: #2005119 - CVE-2021-39275 httpd: out-of-bounds write in
    ap_escape_quotes() via malicious input


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-45
changelog:
  - Resolves: #2007199 - CVE-2021-36160 httpd:2.4/httpd: mod_proxy_uwsgi:
    out-of-bounds read via a crafted request uri-path
  - Resolves: #1972491 - CVE-2021-33193 httpd:2.4/mod_http2: Request splitting via
    HTTP/2 method injection and mod_proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-46
changelog:
  - Resolves: #2035063 - CVE-2021-44790 httpd:2.4/httpd: mod_lua: possible buffer
    overflow when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-47
changelog:
  - Resolves: #2035030 - CVE-2021-44224 httpd:2.4/httpd: possible NULL dereference
    or SSRF in forward proxy configurations


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-48
changelog:
  - Resolves: #2065249 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling
    vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-50
changelog:
  - Resolves: #2065237 - CVE-2022-22719 httpd:2.4/httpd: mod_lua: Use of
    uninitialized value of in r:parsebody
  - Resolves: #2065267 - CVE-2022-22721 httpd:2.4/httpd: core: Possible buffer
    overflow with very large or unlimited LimitXMLRequestBody
  - Resolves: #2065324 - CVE-2022-23943 httpd:2.4/httpd: mod_sed: Read/write
    beyond bounds


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-51
changelog:
  - Resolves: #2097015 - CVE-2022-28614 httpd:2.4/httpd: out-of-bounds read via
    ap_rwrite()
  - Resolves: #2097031 - CVE-2022-28615 httpd:2.4/httpd: out-of-bounds read in
    ap_strcmp_match()
  - Resolves: #2097458 - CVE-2022-30522 httpd:2.4/httpd: mod_sed: DoS
    vulnerability
  - Resolves: #2097480 - CVE-2022-30556 httpd:2.4/httpd: mod_lua: Information
    disclosure with websockets
  - Resolves: #2098247 - CVE-2022-31813 httpd:2.4/httpd: mod_proxy:
    X-Forwarded-For dropped by hop-by-hop mechanism
  - Resolves: #2097451 - CVE-2022-29404 httpd:2.4/httpd: mod_lua: DoS in
    r:parsebody
  - Resolves: #2096997 - CVE-2022-26377 httpd:2.4/httpd: mod_proxy_ajp: Possible
    request smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-51.1
changelog:
  - Resolves: #2165967 - prevent sscg creating /dhparams.pem
  - Resolves: #2165976 - CVE-2006-20001 httpd: mod_dav: out-of-bounds read/write
    of zero byte
  - Resolves: #2165977 - CVE-2022-37436 httpd: mod_proxy: HTTP response splitting
  - Resolves: #2165978 - CVE-2022-36760 httpd: mod_proxy_ajp: Possible request
    smuggling


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-51.5
changelog:
  - Resolves: #2177747 - CVE-2023-25690 httpd:2.4/httpd: HTTP request splitting
    with mod_rewrite and mod_proxy


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.28.20180415git.el8
changelog:
  - hpvd-Set-IgnoreOnIsolate-1-in-systemd-units.patch [bz#1769920]
  - Resolves: bz#1769920
    ([Hyper-V][RHEL8] Running 'systemctl isolate' on any target stops hyperv-daemon services)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.29.20180415git.el8
changelog:
  - hvd-Update-C-files-and-scripts-to-kernel-version-5.7-rc1.patch [bz#1816750]
  - hvd-Add-vmbus_testing-tool-build-files.patch [bz#1816750]
  - Resolves: bz#1816750
    ([Hyper-V][RHEL8.3] Update Hyper-V tools)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.30.20180415git.el8
changelog:
  - hvd-tools-hv-change-http-to-https-in-hv_kvp_daemon.c.patch [bz#1886104]
  - Resolves: bz#1886104
    ([Hyper-V][RHEL8.4] Update Hyper-V-Daemons)


author: Jon Maloy <jmaloy@redhat.com> - 0-0.31.20180415git.el8
changelog:
  - hpvd-Enable-build-on-aarch64.patch [bz#2020141]
  - Resolves: bz#2020141
    ([Hyper-V][RHEL8.6][ARM64] No hyperv-daemons package built for aarch64 platform)


author: Jon Maloy <jmaloy@redhat.com> - 0-0.32.20180415git.el8
changelog:
  - hpvd-hv_set_ifconfig.sh-Use-nmcli-commands.patch [bz#2065202]
  - hpvd-Use-filename-for-connection-profile.patch [bz#2065202]
  - Resolves: bz#2065202
    ([RHEL8.6][Hyper-V]The /usr/libexec/hypervkvpd/hv_set_ifconfig need update since the ifdown/ifup was not supported on RHEL8 [rhel-8.7.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 0-0.33.20180415git
changelog:
  - hpvd-hypervkvpd.service-ordering-fixes.patch [bz#2115761]
  - hpvd-redhat-Add-ConditionalVirtualization-to-the-rest-of-.patch [bz#2115761]
  - Resolves: bz#2115761
    ([Hyper-V][RHEL-8] hypervkvpd.service service ordering)


author: Jon Maloy <jmaloy@redhat.com> - 0-0.34.20180415git.el8_7
changelog:
  - hpvd-redhat-hv_set_if_config-Workaround-for-gateway-numbe.patch [bz#2150255]
  - Resolves: bz#2150255
    ([Hyper-V][RHEL-8] Cannot set gateway properly when set static IPADDR0,NETMASK0,GATEWAY in ifcfg-eth0 [rhel-8.7.0.z])


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.8-8
changelog:
  - Backport latest test fixes in python3-ipatests
    Resolves: RHBZ#2060841
  - extdom: user getorigby{user|group}name if available
    Resolves: RHBZ#2062379
  - Set the mode on ipaupgrade.log during RPM post snipppet
    Resolves: RHBZ#2061957
  - test_krbtpolicy: skip SPAKE-related tests in FIPS mode
    Resolves: RHBZ#1909630


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-1
changelog:
  - Rebase to upstream release 4.9.10
    Remove upstream patches 0002 to 0016 that are part of version 4.9.10
    Remove patches 1101 that is part of version 4.9.10
    Rename patch 0001 to 1002 as it will be used in future RHEL 8 releases
    Add patches 0001 and 0002 to fix build on RHEL 8.7
    Resolves: RHBZ#2079466
    Resolves: RHBZ#2063155
    Resolves: RHBZ#1958777
    Resolves: RHBZ#2068088
    Resolves: RHBZ#2004646
    Resolves: RHBZ#782917
    Resolves: RHBZ#2059396
    Resolves: RHBZ#2092015


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-2
changelog:
  - Preserve user: fix the confusing summary
    Resolves: RHBZ#2022028
  - Only calculate LDAP password grace when the password is expired
    Related: RHBZ#782917


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-6
changelog:
  - webui: Allow grace login limit
    Resolves: RHBZ#2109243
  - check_repl_update: in progress is a boolean
    Resolves: RHBZ#2117303
  - Disabling gracelimit does not prevent LDAP binds
    Resolves: RHBZ#2109236
  - Set passwordgracelimit to match global policy on group pw policies
    Resolves: RHBZ#2115475


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.10-8
changelog:
  - Defer creating the final krb5.conf on clients
    Resolves: RHBZ#2150246
  - Vault: fix interoperability issues with older RHEL systems
    Resolves: RHBZ#2148255


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-3
changelog:
  - Update to shenandoah-jdk8u332-b09 (GA)
  - Update release notes for 8u332-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#2074646


author: Francisco Ferrari Bihurriet <fferrari@redhat.com> - 1:1.8.0.332.b09-4
changelog:
  - RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
  - Resolves: rhbz#2102431


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-5
changelog:
  - Rebase FIPS patches from fips branch and simplify by using a single patch from that repository
  - * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
  - * RH2090378: Revert to disabling system security properties and FIPS mode support together
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Rebase PR2888/RH2055274 cacerts patch so it applies after the current FIPS patch
  - Perform configuration changes (e.g. nss.cfg, nss.fips.cfg, tzdb.dat) in installjdk
  - Enable system security properties in the RPM (now disabled by default in the FIPS repo)
  - Improve security properties test to check both enabled and disabled behaviour
  - Run security properties test with property debugging on
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Resolves: rhbz#2097152
  - Resolves: rhbz#2100675


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u342-b06 (EA)
  - Update release notes for shenandoah-8u342-b06.
  - Switch to EA mode for 8u342 pre-release builds.
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Remove redundant "REPOS" variable from tarball script
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Resolves: rhbz#2083265


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-2
changelog:
  - Update to shenandoah-jdk8u342-b07 (GA)
  - Update release notes for 8u342-b07.
  - Switch to GA mode for final release.
  - Resolves: rhbz#2106507


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-2
changelog:
  - Update to shenandoah-jdk8u345-b01 (GA)
  - Update release notes for 8u345-b01.
  - Resolves: rhbz#2112403


author: Stephan Bergmann <sbergman@redhat.com> - 1:1.8.0.345.b01-3
changelog:
  - Disable copy-jdk-configs for Flatpak builds
  - Fix flatpak builds by exempting them from bootstrap
  - Resolves: rhbz#2102733


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-4
changelog:
  - Sync system cacerts support with RHEL 9, disabling using -Dsecurity.systemCACerts=
  - Move cacerts replacement to install section and retain original of this and tzdb.dat
  - Related: rhbz#2055274


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-5
changelog:
  - Switch to static builds, reducing system dependencies and making build more portable
  - Resolves: rhbz#2048542


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-2
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Rebase FIPS patch against 8u352-b07
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Add test to ensure timezones can be translated
  - * This tarball is embargoed until 2022-10-18 @ 1pm PT. *
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b07-0.2.ea
changelog:
  - Update to shenandoah-jdk8u362-b07 (EA)
  - Update release notes for shenandoah-8u362-b07.
  - Switch to EA mode for 8u362 pre-release builds.
  - Drop JDK-8195607/PR3776/RH1760437 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Drop tzdata patches for 2022d & 2022e (JDK-8294357 & JDK-8295173) which are now upstream
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Drop JDK-8255559/RH2124390 patch which is now upstream
  - Resolves: rhbz#2159910


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b08-2
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Fix broken links and missing release notes in older releases.
  - Drop RH1163501 patch which is not upstream or in 11, 17 & 19 packages and seems obsolete
    - Patch was broken by inclusion of "JDK-8293554: Enhanced DH Key Exchanges"
    - Patch was added for a specific corner case of a 4096-bit DH key on a Fedora host that no longer exists
    - Fedora now appears to be using RSA and the JDK now supports ECC in preference to large DH keys
  - Resolves: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.362.b09-2
changelog:
  - Update cacerts patch to fix OPENJDK-1433 SecurityManager issue
  - Update to shenandoah-jdk8u352-b09 (GA)
  - Update release notes for shenandoah-8u352-b09.
  - Resolves: rhbz#2163595


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.372.b07-1
changelog:
  - Update to shenandoah-jdk8u372-b07 (GA)
  - Update release notes for shenandoah-8u372-b07.
  - Require tzdata 2023c due to inclusion of JDK-8305113 in 8u372-b07
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Drop JDK-8275535/RH2053256 patch which is now upstream
  - Include JDK-8271199 backport early ahead of 8u382 (RH2175317)
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.10-3
changelog:
  - Update to jdk-11.0.15.0+10
  - Update release notes to 11.0.15.0+10
  - Switch to GA mode for release
  - Resolves: rhbz#2073593


author: Francisco Ferrari Bihurriet <fferrari@redhat.com> - 1:11.0.15.0.10-5
changelog:
  - RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
  - Resolves: rhbz#2102430


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.10-6
changelog:
  - Rebase FIPS patches from fips branch and simplify by using a single patch from that repository
  - * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
  - * RH2090378: Revert to disabling system security properties and FIPS mode support together
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Enable system security properties in the RPM (now disabled by default in the FIPS repo)
  - Improve security properties test to check both enabled and disabled behaviour
  - Run security properties test with property debugging on
  - Resolves: rhbz#2099838
  - Resolves: rhbz#2090378


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.16.0.7-0.1.ea
changelog:
  - Add additional patch during tarball generation to align tests with ECC changes
  - Related: rhbz#2083298


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.7-0.1.ea
changelog:
  - Update to jdk-11.0.16+7
  - Update release notes to 11.0.16+7
  - Switch to EA mode for 11.0.16 pre-release builds.
  - Use same tarball naming style as java-17-openjdk and java-latest-openjdk
  - Drop JDK-8257794 patch now upstreamed
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Make use of the vendor version string to store our version & release rather than an upstream release date
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Resolves: rhbz#2083298


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.8-2
changelog:
  - Update to jdk-11.0.16+8
  - Update release notes to 11.0.16+8
  - Switch to GA mode for release
  - Resolves: rhbz#2106515


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-2
changelog:
  - Update to jdk-11.0.16.1+1
  - Update release notes to 11.0.16.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2119527


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-3
changelog:
  - Switch to static builds, reducing system dependencies and making build more portable
  - Resolves: rhbz#2121266


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-1
changelog:
  - Update to jdk-11.0.17+8 (GA)
  - Update release notes to 11.0.17+8
  - Bump HarfBuzz bundled version to 4.4.1 following JDK-8289853
  - Bump FreeType bundled version to 2.12.1 following JDK-8290334
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Update CLDR data with Europe/Kyiv (JDK-8293834)
  - Drop JDK-8292223 patch which we found to be unnecessary
  - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
  - The stdc++lib, zlib & freetype options should always be set from the global, so they are not altered for staticlibs builds
  - Remove freetype sources along with zlib sources
  - Resolves: rhbz#2131862
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.1-0.2.ea
changelog:
  - Update to jdk-11.0.18+1
  - Update release notes to 11.0.18+1
  - Switch to EA mode for 11.0.18 pre-release builds.
  - Drop local copies of JDK-8294357 & JDK-8295173 now upstream contains tzdata 2022e
  - Drop local copy of JDK-8275535 which is finally upstream
  - Related: rhbz#2157797


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.9-0.2.ea
changelog:
  - Update to jdk-11.0.18+9
  - Update release notes to 11.0.18+9
  - Drop local copy of JDK-8293834 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2157797


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-1
changelog:
  - Update to jdk-11.0.18+10 (GA)
  - Update release notes to 11.0.18+10
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
  - Related: rhbz#2157797


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-1
changelog:
  - Update to jdk-11.0.19.0+7
  - Update release notes to 11.0.19.0+7
  - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Rebase FIPS support against 11.0.19+6
  - Rebase RH1750419 alt-java patch against 11.0.19+6
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.0.7-0.1.ea
changelog:
  - Update to jdk-17.0.4.0+7
  - Update release notes to 17.0.4.0+7
  - Switch to EA mode for 17.0.4 pre-release builds.
  - Need to include the '.S' suffix in debuginfo checks after JDK-8284661
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Move EA designator check to prep so failures can be caught earlier
  - Make EA designator check non-fatal while upstream is not maintaining it
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Make use of the vendor version string to store our version & release rather than an upstream release date
  - Include a test in the RPM to check the build has the correct vendor information.
  - Resolves: rhbz#2083316


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.4.0.7-0.2.ea
changelog:
  - retutrned absolute symlinks
  - relative symlinks are breaking cjc, and deeper investigations are necessary
  -- why cjc intentionally skips relative symllinks
  - images have to be workarounded differently
  - Related: rhbz#2100674


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.0.7-0.2.ea
changelog:
  - Revert the following changes until copy-java-configs has adapted to relative symlinks:
  - * Move cacerts replacement to install section and retain original of this and tzdb.dat
  - * Run tests on the installed image, rather than the build image
  - * Introduce variables to refer to the static library installation directories
  - * Use relative symlinks so they work within the image
  - * Run debug symbols check during build stage, before the install strips them
  - The move of turning on system security properties is retained so we don't ship with them off
  - Related: rhbz#2100674


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.0.8-3
changelog:
  - Update to jdk-17.0.4.0+8
  - Update release notes to 17.0.4.0+8
  - Switch to GA mode for release
  - Resolves: rhbz#2106522


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.1.1-2
changelog:
  - Update to jdk-17.0.4.1+1
  - Update release notes to 17.0.4.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2119531


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.1.1-3
changelog:
  - Update FIPS support to bring in latest changes
  - * RH2104724: Avoid import/export of DH private keys
  - * RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
  - * Build the systemconf library on all platforms
  - * RH2048582: Support PKCS#12 keystores
  - * RH2020290: Support TLS 1.3 in FIPS mode
  - Resolves: rhbz#2104724
  - Resolves: rhbz#2092507
  - Resolves: rhbz#2048582
  - Resolves: rhbz#2020290


author: Stephan Bergmann <sbergman@redhat.com> - 1:17.0.4.1.1-4
changelog:
  - Fix flatpak builds (catering for their uncompressed manual pages)
  - Fix flatpak builds by exempting them from bootstrap
  - Resolves: rhbz#2102734


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.1.1-5
changelog:
  - Switch to static builds, reducing system dependencies and making build more portable
  - Resolves: rhbz#2121263


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.1.1-6
changelog:
  - Backport JDK-8288985 to enable use of ChaCha20-Poly1305 with the PKCS11 provider
  - Upstream backport in progress: https://github.com/openjdk/jdk17u-dev/pull/650
  - Resolves: rhbz#2006351


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.5.0.8-1
changelog:
  - Update to jdk-17.0.5+8 (GA)
  - Update release notes to 17.0.5+8 (GA)
  - Bump HarfBuzz bundled version to 4.4.1 following JDK-8289853
  - Bump FreeType bundled version to 2.12.1 following JDK-8290334
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Update CLDR data with Europe/Kyiv (JDK-8293834)
  - Drop JDK-8292223 patch which we found to be unnecessary
  - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
  - The stdc++lib, zlib & freetype options should always be set from the global, so they are not altered for staticlibs builds
  - Remove freetype sources along with zlib sources
  - Resolves: rhbz#2132502
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.5.0.8-4
changelog:
  - Update FIPS support to bring in latest changes
  - * Add nss.fips.cfg support to OpenJDK tree
  - * RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
  - * Remove forgotten dead code from RH2020290 and RH2104724
  - Drop local nss.fips.cfg.in handling now this is handled in the patched OpenJDK build
  - Resolves: rhbz#2147473


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.1-0.2.ea
changelog:
  - Update to jdk-17.0.6+1
  - Update release notes to 17.0.6+1
  - Switch to EA mode for 17.0.6 pre-release builds.
  - Re-enable EA upstream status check now it is being actively maintained.
  - Drop JDK-8294357 (tzdata2022d) & JDK-8295173 (tzdata2022e) local patches which are now upstream
  - Drop JDK-8275535 local patch now this has been accepted and backported upstream
  - Bump tzdata requirement to 2022e now the package is available in RHEL
  - Related: rhbz#2153010


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.9-0.2.ea
changelog:
  - Update to jdk-17.0.6+9
  - Update release notes to 17.0.6+9
  - Drop local copy of JDK-8293834 now this is upstream
  - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
  - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
  - Resolves: rhbz#2153010


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-2
changelog:
  - Update to jdk-17.0.6.0+10
  - Update release notes to 17.0.6.0+10
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
  - Related: rhbz#2153010


author: Stephan Bergmann <sbergman@redhat.com> - 1:17.0.6.0.10-3
changelog:
  - Fix flatpak builds by disabling TestTranslations test due to missing tzdb.dat
  - Related: rhbz#2160111


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-3
changelog:
  - Update FIPS support to bring in latest changes
  - * OJ1357: Fix issue on FIPS with a SecurityManager in place
  - Related: rhbz#2147473


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-1
changelog:
  - Update to jdk-17.0.7.0+7
  - Update release notes to 17.0.7.0+7
  - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
  - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
  - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
  - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
  - Update FIPS support against 17.0.7+6 and bring in latest changes:
  - * RH2134669: Add missing attributes when registering services in FIPS mode.
  - * test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
  - * RH1940064: Enable XML Signature provider in FIPS mode
  - * RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
  - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
  - Resolves: rhbz#2185182
  - Resolves: rhbz#2186835
  - Resolves: rhbz#2186827
  - Resolves: rhbz#2186831


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.1.1.el8]
changelog:
  - i40e: Fix kernel crash during module removal (Ivan Vecera) [2091489]
  - redhat: enable zstream release numbering for rhel 8.7 (Jarod Wilson)
  - ice: Allow operation with reduced device MSI-X (Petr Oros) [2102844]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.2.1.el8]
changelog:
  - EDAC/ghes: Set the DIMM label unconditionally (Aristeu Rozanski) [2109712]
  - configs: enable CONFIG_HP_ILO for aarch64 (Mark Salter) [2123508]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.3.1.el8]
changelog:
  - iwlwifi: limit fw version for AC9560 to avoid fw crash (Íñigo Huguet) [2129297]
  - sfc: fix null pointer dereference in efx_hard_start_xmit (Íñigo Huguet) [2119638]
  - sfc: fix TX channel offset when using legacy interrupts (Íñigo Huguet) [2119638]
  - netfilter: conntrack: reduce timeout when receiving out-of-window fin or rst (Florian Westphal) [2047366]
  - netfilter: conntrack: remove unneeded indent level (Florian Westphal) [2047366]
  - netfilter: conntrack: ignore overly delayed tcp packets (Florian Westphal) [2047366]
  - netfilter: conntrack: prepare tcp_in_window for ternary return value (Florian Westphal) [2047366]
  - netfilter: conntrack: remove pr_debug callsites from tcp tracker (Florian Westphal) [2047366]
  - netfilter: conntrack: work around exceeded receive window (Florian Westphal) [2047366]
  - netfilter: conntrack: improve RST handling when tuple is re-used (Florian Westphal) [2047366]
  - netfilter: conntrack: avoid misleading 'invalid' in log message (Florian Westphal) [2047366]
  - netfilter: remove BUG_ON() after skb_header_pointer() (Florian Westphal) [2047366]
  - iavf: Detach device during reset task (Petr Oros) [2069206]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.5.1.el8_7]
changelog:
  - ice: Fix interface being down after reset with link-down-on-close flag on (Petr Oros) [2136216 2024110]
  - ice: Fix crash by keep old cfg when update TCs more than queues (Petr Oros) [2130992 2129902]
  - ice: Fix tunnel checksum offload with fragmented traffic (Petr Oros) [2130992 2129902]
  - ice: handle E822 generic device ID in PLDM header (Petr Oros) [2130992 2129902]
  - ice: ethtool: Prohibit improper channel config for DCB (Petr Oros) [2130992 2129902]
  - ice: ethtool: advertise 1000M speeds properly (Petr Oros) [2130992 2129902]
  - ice: Fix switchdev rules book keeping (Petr Oros) [2130992 2129902]
  - ice: fix access-beyond-end in the switch code (Petr Oros) [2130992 2129902]
  - eth: ice: silence the GCC 12 array-bounds warning (Petr Oros) [2130992 2129902]
  - ice: Expose RSS indirection tables for queue groups via ethtool (Petr Oros) [2130992 2129902]
  - Revert "ice: Hide bus-info in ethtool for PRs in switchdev mode" (Petr Oros) [2130992 2129902]
  - ice: remove period on argument description in ice_for_each_vf (Petr Oros) [2130992 2129902]
  - ice: add a function comment for ice_cfg_mac_antispoof (Petr Oros) [2130992 2129902]
  - ice: fix wording in comment for ice_reset_vf (Petr Oros) [2130992 2129902]
  - ice: remove return value comment for ice_reset_all_vfs (Petr Oros) [2130992 2129902]
  - ice: always check VF VSI pointer values (Petr Oros) [2130992 2129902]
  - ice: add newline to dev_dbg in ice_vf_fdir_dump_info (Petr Oros) [2130992 2129902]
  - ice: get switch id on switchdev devices (Petr Oros) [2130992 2129902]
  - ice: return ENOSPC when exceeding ICE_MAX_CHAIN_WORDS (Petr Oros) [2130992 2129902]
  - ice: introduce common helper for retrieving VSI by vsi_num (Petr Oros) [2130992 2129902]
  - ice: use min_t() to make code cleaner in ice_gnss (Petr Oros) [2130992 2129902]
  - ice: Add mpls+tso support (Petr Oros) [2130992 2129902]
  - ice: switch: convert packet template match code to rodata (Petr Oros) [2130992 2129902]
  - ice: switch: use convenience macros to declare dummy pkt templates (Petr Oros) [2130992 2129902]
  - ice: switch: use a struct to pass packet template params (Petr Oros) [2130992 2129902]
  - ice: switch: unobscurify bitops loop in ice_fill_adv_dummy_packet() (Petr Oros) [2130992 2129902]
  - ice: switch: add and use u16[] aliases to ice_adv_lkup_elem::{h, m}_u (Petr Oros) [2130992 2129902]
  - ice: Support GTP-U and GTP-C offload in switchdev (Petr Oros) [2130992 2129902]
  - ice: Remove useless DMA-32 fallback configuration (Petr Oros) [2130992 2129902]
  - ice: switch to napi_build_skb() (Petr Oros) [2130992 2129902]
  - redhat: switch to z-stream dist tag and build targets (Jarod Wilson)
  - block: avoid sign extend problem with default queue flags mask (Nico Pache) [2135813]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.6.1.el8_7]
changelog:
  - ice: Add low latency Tx timestamp read (Petr Oros) [2136036 2092425]
  - ice: introduce ice_ptp_reset_cached_phctime function (Petr Oros) [2136036 2092425]
  - ice: re-arrange some static functions in ice_ptp.c (Petr Oros) [2136036 2092425]
  - ice: track and warn when PHC update is late (Petr Oros) [2136036 2092425]
  - ice: track Tx timestamp stats similar to other Intel drivers (Petr Oros) [2136036 2092425]
  - ice: implement adjfine with mul_u64_u64_div_u64 (Petr Oros) [2136036 2092425]
  - ice: Add EXTTS feature to the feature bitmap (Petr Oros) [2136036 2092425]
  - math: Export mul_u64_u64_div_u64 (Petr Oros) [2136036 2092425]
  - vfio/type1: Unpin zero pages (Alex Williamson) [2128515 2123015]
  - net: atlantic: remove aq_nic_deinit() when resume (Íñigo Huguet) [2131935 2130839]
  - net: atlantic: remove deep parameter on suspend/resume functions (Íñigo Huguet) [2131935 2130839]
  - CI: Use zstream builder container (Veronika Kabatova)
  - CI: Add disttag override for 8.7 (Veronika Kabatova)


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.7.1.el8_7]
changelog:
  - ice: Add additional CSR registers to ETHTOOL_GREGS (Petr Oros) [2136513 2131024]
  - i40e: Fix set max_tx_rate when it is lower than 1 Mbps (Petr Oros) [2137270 2106964]
  - i40e: Fix VF set max MTU size (Petr Oros) [2137270 2106964]
  - iavf: Fix set max MTU size with port VLAN and jumbo frames (Petr Oros) [2137270 2106964]
  - iavf: Fix bad page state (Petr Oros) [2137270 2106964]
  - Revert "scsi: mpi3mr: Schedule IRQ kthreads only on non-RT kernels" (Jarod Wilson)
  - scsi: mpi3mr: Schedule IRQ kthreads only on non-RT kernels (Tomas Henzl) [2139216]
  - Revert "ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems" (Jarod Wilson)
  - ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems (Wei Huang) [2142170 2130653]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.8.1.el8_7]
changelog:
  - scsi: mpi3mr: Schedule IRQ kthreads only on non-RT kernels (Tomas Henzl) [2139216 2134535]
  - RDMA/mlx5: Set local port to one when accessing counters (Mohammad Kabat) [2141957 2077119]
  - drm/mgag200: Fix PLL setup for G200_SE_A rev >=4 (Jocelyn Falempe) [2140152 2130159]
  - iavf: Do not restart Tx queues after reset task failure (Petr Oros) [2149081 2134005]
  - iavf: Fix a crash during reset task (Petr Oros) [2149081 2134005]
  - scsi: core: Allow the ALUA transitioning state enough time (Tomas Henzl) [2147374 2084250]
  - scsi: core: Return BLK_STS_TRANSPORT for ALUA transitioning (Tomas Henzl) [2147374 2084250]
  - i40e: Fix DMA mappings leak (Ivan Vecera) [2138205 2077847]
  - net: usb: ax88179_178a: Fix packet receiving (Jose Ignacio Tornos Martinez) [2142724 2142725] {CVE-2022-2964}
  - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (Jose Ignacio Tornos Martinez) [2142724 2142725] {CVE-2022-2964}


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.9.1.el8_7]
changelog:
  - Documentation/admin-guide: Document nomodeset kernel parameter (Jocelyn Falempe) [2145218 2143952]
  - drm: Move nomodeset kernel parameter to the DRM subsystem (Jocelyn Falempe) [2145218 2143952]
  - wait: Fix __wait_event_hrtimeout for RT/DL tasks (Derek Barbosa) [2138953 2125233]
  - scsi: zfcp: Fix missing auto port scan and thus missing target ports (Tobias Huschle) [2127849 2121089]
  - net: Fix return value of qdisc ingress handling on success (Ivan Vecera) [2141878 2131361]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.10.1.el8_7]
changelog:
  - scsi: target: loop: Fix handling of aborted TMRs (Maurizio Lombardi) [2144583 2141713]
  - ice: virtchnl rss hena support (Petr Oros) [2148130]
  - ice: Fix configuring VIRTCHNL_OP_CONFIG_VSI_QUEUES with unbalanced queues (Michal Schmidt) [2142017 2137378]
  - ice: Add support Flex RXD (Michal Schmidt) [2138157 2131310]
  - netfilter: flowtable: fix stuck flows on cleanup due to pending work (Phil Sutter) [2134084 2131370]
  - netfilter: flowtable: add function to invoke garbage collection immediately (Phil Sutter) [2134084 2131370]
  - netfilter: flowtable: pass flowtable to nf_flow_table_iterate() (Phil Sutter) [2134084 2131370]
  - netfilter: flowtable: separate replace, destroy and stats to different workqueues (Phil Sutter) [2134084 2131370]
  - x86/paravirt: Add a dummy __x86_paravirt_patch_template() function (Waiman Long) [2152206 2144161]
  - x86/paravirt: Fix kABI breakage in struct pv_mmu_ops (Waiman Long) [2152206 2144161]
  - drm/i915: fix TLB invalidation for Gen12 video and compute engines (Wander Lairson Costa) [2148149 2148150] {CVE-2022-4139}
  - PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (Emanuele Giuseppe Esposito) [2150912 2082836]
  - iavf: Fix cached head and tail value for iavf_get_tx_pending (Stefan Assmann) [2149742 2103944]
  - iavf: Fix change VF's mac address (Stefan Assmann) [2149742 2103944]
  - iavf: Fix race between iavf_close and iavf_reset_task (Stefan Assmann) [2149742 2103944]
  - net: ethernet: move from strlcpy with unused retval to strscpy (Stefan Assmann) [2149742 2103944]
  - iavf: Fix 'tc qdisc show' listing too many queues (Stefan Assmann) [2149742 2103944]
  - iavf: Fix max_rate limiting (Stefan Assmann) [2149742 2103944]
  - iavf: Check for duplicate TC flower filter before parsing (Stefan Assmann) [2149742 2103944]
  - iavf: Fix handling of dummy receive descriptors (Stefan Assmann) [2149742 2103944]
  - iavf: Disallow changing rx/tx-frames and rx/tx-frames-irq (Stefan Assmann) [2149742 2103944]
  - intel/iavf:fix repeated words in comments (Stefan Assmann) [2149742 2103944]
  - intel: remove unused macros (Stefan Assmann) [2149742 2103944]
  - iavf: Add waiting for response from PF in set mac (Stefan Assmann) [2149742 2103944]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.11.1.el8_7]
changelog:
  - NFSD: Protect against send buffer overflow in NFSv3 READ (Scott Mayhew) [2143172 2141774] {CVE-2022-43945}
  - NFSD: Protect against send buffer overflow in NFSv2 READ (Scott Mayhew) [2143172 2141774] {CVE-2022-43945}
  - NFSD: Protect against send buffer overflow in NFSv3 READDIR (Scott Mayhew) [2143172 2141774] {CVE-2022-43945}
  - NFSD: Protect against send buffer overflow in NFSv2 READDIR (Scott Mayhew) [2143172 2141774] {CVE-2022-43945}
  - SUNRPC: Fix svcxdr_init_encode's buflen calculation (Scott Mayhew) [2143172 2141774] {CVE-2022-43945}
  - SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation (Scott Mayhew) [2143172 2141774] {CVE-2022-43945}
  - panic, kexec: make __crash_kexec() NMI safe (Valentin Schneider) [2139580 2134126]
  - kexec: turn all kexec_mutex acquisitions into trylocks (Valentin Schneider) [2139580 2134126]
  - kexec: move locking into do_kexec_load (Valentin Schneider) [2139580 2134126]
  - vdpa/mlx5: re-create forwarding rules after mac modified (Laurent Vivier) [2152912 2145136]
  - timers/nohz: Last resort update jiffies on nohz_full IRQ entry (Waiman Long) [2153653 2108387]
  - irq: Call tick_irq_enter() inside HARDIRQ_OFFSET (Waiman Long) [2153653 2108387]
  - irqtime: Move irqtime entry accounting after irq offset incrementation (Waiman Long) [2153653 2108387]
  - sched/vtime: Consolidate IRQ time accounting (Waiman Long) [2153653 2108387]
  - s390/vtime: Use the generic IRQ entry accounting (Waiman Long) [2153653 2108387]
  - sched/cputime: Remove symbol exports from IRQ time accounting (Waiman Long) [2153653 2108387]
  - genirq/irqdomain: Don't try to free an interrupt that has no mapping (Waiman Long) [2153653 2108387]
  - genirq: Provide __irq_enter/exit_raw() (Waiman Long) [2153653 2108387]
  - powerpc/time: Only set CONFIG_ARCH_HAS_SCALED_CPUTIME on PPC64 (Waiman Long) [2153653 2108387]
  - powerpc/time: isolate scaled cputime accounting in dedicated functions. (Waiman Long) [2153653 2108387]
  - PCI: hv: Fix synchronization between channel callback and hv_pci_bus_exit() (Mohammed Gamal) [2155280 2144708]
  - PCI: hv: Fix synchronization between channel callback and hv_compose_msi_msg() (Mohammed Gamal) [2155280 2144708]
  - PCI: hv: Use vmbus_requestor to generate transaction IDs for VMbus hardening (Mohammed Gamal) [2155280 2144708]
  - net/mlx5e: TC, Reject forwarding from internal port to internal port (Mohammad Kabat) [2141959 2131345]
  - hv_netvsc: Fix race between VF offering and VF association message from host (Mohammed Gamal) [2155272 2149279]
  - x86/mce: Reduce number of machine checks taken during recovery (Prarit Bhargava) [2137592 2104388]
  - cgroup/cpuset: Reduce cpuset_rwsem writer latency (Waiman Long) [2153108 2149031]
  - rcu/exp: Mark current CPU as exp-QS in IPI loop second pass (Waiman Long) [2153108 2149031]
  - rcu: Always inline rcu_dynticks_task*_{enter,exit}() (Waiman Long) [2153108 2149031]
  - rcu: Fix existing exp request check in sync_sched_exp_online_cleanup() (Waiman Long) [2153108 2149031]
  - rcu: Fix macro name CONFIG_TASKS_RCU_TRACE (Waiman Long) [2153108 2149031]
  - rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock (Waiman Long) [2153108 2149031]
  - rcu: Fix to include first blocked task in stall warning (Waiman Long) [2153108 2149031]
  - cgroup: Use cgroup_attach_{lock,unlock}() from cgroup_attach_task_all() (Waiman Long) [2153108 2149031]
  - cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() (Waiman Long) [2153108 2149031]
  - cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock (Waiman Long) [2153108 2149031]
  - cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree (Waiman Long) [2153108 2149031]
  - cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug (Waiman Long) [2153108 2149031]
  - cgroup: reduce dependency on cgroup_mutex (Waiman Long) [2153108 2149031]
  - sunrpc: Set sk_allocation to GFP_NOFS to avoid using current->task_frag. (Guillaume Nault) [2153230 2089660]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.12.1.el8_7]
changelog:
  - x86/fpu: Prevent FPU state corruption (Oleksandr Natalenko) [2134586 2130890]
  - x86/fpu: Drop fpregs lock before inheriting FPU permissions (Eder Zulian) [2154460 2153549]
  - kernel-doc: fix undefined args variable (Jan Stancek) [2157905 2134954]
  - mm: memcontrol: fix potential oom_lock recursion deadlock (Waiman Long) [2157922 2138886]
  - memcg: prohibit unconditional exceeding the limit of dying tasks (Waiman Long) [2157922 2138886]
  - mm, oom: do not trigger out_of_memory from the #PF (Waiman Long) [2157922 2138886]
  - mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks (Waiman Long) [2157922 2138886]
  - mm: memcontrol: don't count limit-setting reclaim as memory pressure (Waiman Long) [2157922 2138886]
  - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (Thomas Huth) [2158813 2151854]
  - net: mana: Fix race on per-CQ variable napi work_done (Emanuele Giuseppe Esposito) [2155437 2151722]
  - mei: me: add adler lake point S DID (Prarit Bhargava) [2141783 2141602]
  - PCI: hv: Only reuse existing IRTE allocation for Multi-MSI (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Fix the definition of vector in hv_compose_msi_msg() (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Fix interrupt mapping for multi-MSI (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Reuse existing IRTE allocation in compose_msi_msg() (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Fix multi-MSI to allow more than one MSI vector (Emanuele Giuseppe Esposito) [2155289 2100275]
  - drm/ast: Support multiple outputs (Jarod Wilson) [2149287 2147553]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.13.1.el8_7]
changelog:
  - mm/cgroup/reclaim: fix dirty pages throttling on cgroup v1 (Waiman Long) [2160221]
  - mm: vmscan: remove deadlock due to throttling failing to make progress (Waiman Long) [2160221]
  - mm: vmscan: reduce throttling due to a failure to make progress -fix (Waiman Long) [2160221]
  - mm: vmscan: Reduce throttling due to a failure to make progress (Waiman Long) [2160221]
  - mm/vmscan: delay waking of tasks throttled on NOPROGRESS (Waiman Long) [2160221]
  - mm/vmscan: increase the timeout if page reclaim is not making progress (Waiman Long) [2160221]
  - mm/vmscan: centralise timeout values for reclaim_throttle (Waiman Long) [2160221]
  - mm/page_alloc: remove the throttling logic from the page allocator (Waiman Long) [2160221]
  - mm/writeback: throttle based on page writeback instead of congestion (Waiman Long) [2160221]
  - mm/vmscan: throttle reclaim when no progress is being made (Waiman Long) [2160221]
  - mm/vmscan: throttle reclaim and compaction when too may pages are isolated (Waiman Long) [2160221]
  - mm/vmscan: throttle reclaim until some writeback completes if congested (Waiman Long) [2160221]
  - mm/vmscan.c: delete or fix duplicated words (Waiman Long) [2160221]
  - mm,page_alloc: PF_WQ_WORKER threads must sleep at should_reclaim_retry() (Nico Pache) [2160221]
  - ceph: avoid putting the realm twice when decoding snaps fails (Xiubo Li) [2155797 2139881]
  - mm/mremap: hold the rmap lock in write mode when moving page table entries. (Waiman Long) [2140944] {CVE-2022-41222}
  - mm/mremap: use pmd/pud_poplulate to update page table entries (Waiman Long) [2140944] {CVE-2022-41222}
  - mm/mremap: don't enable optimized PUD move if page table levels is 2 (Waiman Long) [2140944] {CVE-2022-41222}
  - mm/mremap: convert huge PUD move to separate helper (Waiman Long) [2140944] {CVE-2022-41222}
  - mm/mremap: fix BUILD_BUG_ON() error in get_extent (Waiman Long) [2140944] {CVE-2022-41222}
  - mm/mremap.c: fix extent calculation (Waiman Long) [2140944] {CVE-2022-41222}
  - x86: mremap speedup - Enable HAVE_MOVE_PUD (Waiman Long) [2140944] {CVE-2022-41222}
  - mm: speedup mremap on 1GB or larger regions (Waiman Long) [2140944] {CVE-2022-41222}
  - mm/mremap: start addresses are properly aligned (Waiman Long) [2140944] {CVE-2022-41222}
  - mm/mremap: calculate extent in one place (Waiman Long) [2140944] {CVE-2022-41222}
  - mm/mremap: it is sure to have enough space when extent meets requirement (Waiman Long) [2140944] {CVE-2022-41222}
  - s390/boot: add secure boot trailer (Tobias Huschle) [2151530 2141967]
  - i40e: Fix VF hang when reset is triggered on another VF (Ivan Vecera) [2160460 2103801]
  - i2c: ismt: Fix an out-of-bounds bug in ismt_access() (Prarit Bhargava) [2154388 2119066] {CVE-2022-2873}
  - iavf: schedule watchdog immediately when changing primary MAC (Michal Schmidt) [2163257 2152493]
  - iavf: Move netdev_update_features() into watchdog task (Michal Schmidt) [2163257 2152493]
  - iavf: fix temporary deadlock and failure to set MAC address (Michal Schmidt) [2163257 2152493]
  - iavf: Fix error handling in iavf_init_module() (Michal Schmidt) [2163257 2152493]
  - iommu/vt-d: Clean up si_domain in the init_dmars() error path (Jerry Snitselaar) [2149474 2118428]
  - x86/pci/xen: Use msi_msg shadow structs (Jerry Snitselaar) [2149474 2118428]
  - iommu/intel: Use msi_msg shadow structs (Jerry Snitselaar) [2149474 2118428]
  - PCI: MSI: Fix Kconfig dependencies for PCI_MSI_ARCH_FALLBACKS (Jerry Snitselaar) [2149474 2118428]
  - x86/apic/msi: Unbreak DMAR and HPET MSI (Jerry Snitselaar) [2149474 2118428]
  - iommu/amd: Remove domain search for PCI/MSI (Jerry Snitselaar) [2149474 2118428]
  - iommu/vt-d: Remove domain search for PCI/MSI[X] (Jerry Snitselaar) [2149474 2118428]
  - x86/irq: Make most MSI ops XEN private (Jerry Snitselaar) [2149474 2118428]
  - x86/irq: Cleanup the arch_*_msi_irqs() leftovers (Jerry Snitselaar) [2149474 2118428]
  - PCI/MSI: Make arch_.*_msi_irq[s] fallbacks selectable (Jerry Snitselaar) [2149474 2118428]
  - x86/xen: Wrap XEN MSI management into irqdomain (Jerry Snitselaar) [2149474 2118428]
  - x86/xen: Consolidate XEN-MSI init (Jerry Snitselaar) [2149474 2118428]
  - x86/xen: Rework MSI teardown (Jerry Snitselaar) [2149474 2118428]
  - x86/xen: Make xen_msi_init() static and rename it to xen_hvm_msi_init() (Jerry Snitselaar) [2149474 2118428]
  - x86/irq: Move apic_post_init() invocation to one place (Jerry Snitselaar) [2149474 2118428]
  - x86/msi: Use generic MSI domain ops (Jerry Snitselaar) [2149474 2118428]
  - x86/msi: Remove pointless vcpu_affinity callback (Jerry Snitselaar) [2149474 2118428]
  - iommu/vt-d: Fix compile error with CONFIG_PCI_ATS not set (Myron Stowe) [2149474 2118428]
  - iommu/vt-d: Cure VF irqdomain hickup (Myron Stowe) [2149474 2118428]
  - x86/pci: Set default irq domain in pcibios_add_device() (Myron Stowe) [2149474 2118428]
  - iommm/amd: Store irq domain in struct device (Myron Stowe) [2149474 2118428]
  - iommm/vt-d: Store irq domain in struct device (Myron Stowe) [2149474 2118428]
  - PCI/MSI: Provide pci_dev_has_special_msi_domain() helper (Myron Stowe) [2149474 2118428]
  - x86/msi: Consolidate MSI allocation (Myron Stowe) [2149474 2118428]
  - PCI/MSI: Rework pci_msi_domain_calc_hwirq() (Myron Stowe) [2149474 2118428]
  - x86/irq: Consolidate UV domain allocation (Myron Stowe) [2149474 2118428]
  - x86/irq: Consolidate DMAR irq allocation (Myron Stowe) [2149474 2118428]
  - x86_ioapic_Consolidate_IOAPIC_allocation (Myron Stowe) [2149474 2118428]
  - x86/msi: Consolidate HPET allocation (Myron Stowe) [2149474 2118428]
  - iommu/irq_remapping: Consolidate irq domain lookup (Myron Stowe) [2149474 2118428]
  - iommu/amd: Consolidate irq domain getter (Myron Stowe) [2149474 2118428]
  - iommu/vt-d: Consolidate irq domain getter (Myron Stowe) [2149474 2118428]
  - x86/irq: Add allocation type for parent domain retrieval (Myron Stowe) [2149474 2118428]
  - irqdomain: Export irq_domain_update_bus_token (Myron Stowe) [2149474 2118428]
  - gitlab-ci: use CI templates from production branch (Michael Hofmann)
  - iavf: remove INITIAL_MAC_SET to allow gARP to work properly (Stefan Assmann) [2149745 1938635]
  - Revert "scsi: iscsi: ql4xxx: Use per-session workqueue for unbinding" (Chris Leech) [2152734 2122624]
  - Revert "scsi: iscsi: Use the session workqueue for recovery" (Chris Leech) [2152734 2122624]
  - arm64/bpf: Remove 128MB limit for BPF JIT programs (Yauheni Kaliuta) [2152138 2140163]
  - bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT (Yauheni Kaliuta) [2152138 2140163]
  - arm64: extable: add `type` and `data` fields (Yauheni Kaliuta) [2152138 2140163]
  - arm64: extable: use `ex` for `exception_table_entry` (Yauheni Kaliuta) [2152138 2140163]
  - arm64: extable: make fixup_exception() return bool (Yauheni Kaliuta) [2152138 2140163]
  - arm64: extable: consolidate definitions (Yauheni Kaliuta) [2152138 2140163]
  - arm64: kvm: use kvm_exception_table_entry (Yauheni Kaliuta) [2152138 2140163]
  - be2net: Fix buffer overflow in be_get_module_eeprom (Josef Oskera) [2160182 2126917]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.14.1.el8_7]
changelog:
  - ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems (Wei Huang) [2142170 2130653]
  - KVM: x86: nSVM: implement nested LBR virtualization (Emanuele Giuseppe Esposito) [2166362 2155149]
  - KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running (Emanuele Giuseppe Esposito) [2166362 2155149]
  - kvm: x86: SVM: use vmcb* instead of svm->vmcb where it makes sense (Emanuele Giuseppe Esposito) [2166362 2155149]
  - KVM: x86: nSVM: implement nested VMLOAD/VMSAVE (Emanuele Giuseppe Esposito) [2166362 2155149]
  - IB/iser: Fix login with authentication (Kamal Heib) [2161750 2120676]
  - act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti) [2164648 2131339] {CVE-2022-4269}
  - net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti) [2164648 2131339] {CVE-2022-4269}
  - redhat/configs: Set CONFIG_X86_AMD_PSTATE to 'm' (Prarit Bhargava) [2151275 2145246]
  - KVM: x86: smm: preserve interrupt shadow in SMRAM (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: SVM: don't save SVM state to SMRAM when VM is not long mode capable (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: SVM: use smram structs (Maxim Levitsky) [2166368 2097144]
  - KVM: svm: drop explicit return value of kvm_vcpu_map (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: smm: use smram struct for 64 bit smram load/restore (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: smm: use smram struct for 32 bit smram load/restore (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: smm: use smram structs in the common code (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: smm: add structs for KVM's smram layout (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: smm: check for failures on smm entry (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: do not go through ctxt->ops when emulating rsm (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: move SMM exit to a new file (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: move SMM entry to a new file (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: start moving SMM-related functions to new files (Maxim Levitsky) [2166368 2097144]
  - bug: introduce ASSERT_STRUCT_OFFSET (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: Rename and expose helper to detect if INIT/SIPI are allowed (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: emulator: update the emulation mode after CR0 write (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: emulator: update the emulation mode after rsm (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: emulator: introduce emulator_recalc_and_set_mode (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: emulator: em_sysexit should update ctxt->mode (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: Bug the VM if the emulator accesses a non-existent GPR (Maxim Levitsky) [2166368 2097144]
  - \KVM: x86: Reduce the number of emulator GPRs to '8' for 32-bit KVM (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: Use 16-bit fields to track dirty/valid emulator GPRs (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: Omit VCPU_REGS_RIP from emulator's _regs array (Maxim Levitsky) [2166368 2097144]
  - \KVM: x86: Harden _regs accesses to guard against buggy input (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: Grab regs_dirty in local 'unsigned long' (Maxim Levitsky) [2166368 2097144]
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Wander Lairson Costa) [2152571 2152572] {CVE-2022-4378}
  - proc: avoid integer type confusion in get_proc_long (Wander Lairson Costa) [2152571 2152572] {CVE-2022-4378}


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.15.1.el8_7]
changelog:
  - net/mlx5e: Fix use-after-free when reverting termination table (Amir Tzin) [2167640 2112927]
  - net/mlx5: Do not query pci info while pci disabled (Amir Tzin) [2167645 2129249]
  - x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly (Dean Nelson) [2168384 2122850]
  - x86/fpu: Exclude dynamic states from init_fpstate (Dean Nelson) [2168384 2122850]
  - x86/fpu: Fix the init_fpstate size check with the actual size (Dean Nelson) [2168384 2122850]
  - x86/fpu: Configure init_fpstate attributes orderly (Dean Nelson) [2168384 2122850]
  - x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation (Dean Nelson) [2168384 2122850]
  - net/mlx5: E-Switch, properly handle ingress tagged packets on VST (Amir Tzin) [2166665 2096109]
  - cpuhotplug: Fix KABI breakage (Prarit Bhargava) [2162763 2156529]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.16.1.el8_7]
changelog:
  - ipv6: fix panic when fib_lookup_arg->result is fib6_info (Jiri Benc) [2167602 2140599]
  - ceph: blocklist the kclient when receiving corrupted snap trace (Xiubo Li) [2168896 2162414]
  - ceph: move mount state enum to super.h (Xiubo Li) [2168896 2162414]
  - s390/kexec: fix ipl report address for kdump (Tobias Huschle) [2166296 2161328]
  - mm, compaction: fix fast_isolate_around() to stay within boundaries (Daniel Vacek) [2170576 2149309]
  - scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (Emanuele Giuseppe Esposito) [2170228 2150659]
  - netfilter: conntrack: handle tcp challenge acks during connection reuse (Florian Westphal) [2165587 2158726]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.17.1.el8_7]
changelog:
  - net: mana: Add rmb after checking owner bits (Mohammed Gamal) [2173103 2139462]
  - net: mana: Add support of XDP_REDIRECT action (Mohammed Gamal) [2173103 2139462]
  - net: mana: Add the Linux MANA PF driver (Mohammed Gamal) [2173103 2139462]
  - ice: fix lost multicast packets in promisc mode (Ken Cox) [2172550 2138215]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.19.1.el8_7]
changelog:
  - s390/dasd: fix no record found for raw_track_access (Tobias Huschle) [2167776 2161270]
  - locking/rwsem: Disable preemption in all down_read*() and up_read() code paths (Waiman Long) [2170939 2162139]
  - locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath (Waiman Long) [2170939 2162139]
  - locking/rwsem: Allow slowpath writer to ignore handoff bit if not set by first waiter (Waiman Long) [2170939 2162139]
  - locking/rwsem: Always try to wake waiters in out_nolock path (Waiman Long) [2170939 2162139]
  - locking/rwsem: No need to check for handoff bit if wait queue empty (Waiman Long) [2170939 2162139]
  - locking/rwsem: Make handoff bit handling more consistent (Waiman Long) [2170939 2162139]
  - locking/rwsem: Disable preemption while trying for rwsem lock (Waiman Long) [2170939 2162139]
  - locking/rwsem: Conditionally wake waiters in reader/writer slowpaths (Waiman Long) [2170939 2162139]
  - locking: Make owner_on_cpu() into <linux/sched.h> (Waiman Long) [2170939 2162139]
  - locking/rwsem: Optimize down_read_trylock() under highly contended case (Waiman Long) [2170939 2162139]
  - locking/rwsem: Fix comments about reader optimistic lock stealing conditions (Waiman Long) [2170939 2162139]
  - locking/rwsem: Disable preemption for spinning region (Waiman Long) [2170939 2162139]
  - locking: Remove rcu_read_{,un}lock() for preempt_{dis,en}able() (Waiman Long) [2170939 2162139]
  - watchdog: fix UAF in reboot notifier handling in watchdog core code (Wander Lairson Costa) [2139770 2131308]
  - netfilter: nf_conntrack_irc: Tighten matching on DCC message (Wander Lairson Costa) [2139770 2131308]
  - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (Jaroslav Kysela) [2163400 2163401] {CVE-2023-0266}
  - net/mlx5e: Fix enabling sriov while tc nic rules are offloaded (Amir Tzin) [2167647 2112925]
  - net/mlx5: E-Switch, pair only capable devices (Amir Tzin) [2167647 2112925]
  - net/mlx5: Fix mlx5_get_next_dev() peer device matching (Amir Tzin) [2167647 2112925]
  - net/mlx5: Lag, filter non compatible devices (Amir Tzin) [2167647 2112925]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.19.2.el8_7.gf5e8]
changelog:
  - ovl: fail on invalid uid/gid mapping at copy up (Miklos Szeredi) [2165341 2165342] {CVE-2023-0386}


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.1.1.rt7.211.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-425.1.1.rt7.211.el8 [2067251]
  - i40e: Fix kernel crash during module removal (Ivan Vecera) [2091489]
  - redhat: enable zstream release numbering for rhel 8.7 (Jarod Wilson)
  - ice: Allow operation with reduced device MSI-X (Petr Oros) [2102844]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.2.1.rt7.212.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-425.2.1.rt7.212.el8 [2067251]
  - EDAC/ghes: Set the DIMM label unconditionally (Aristeu Rozanski) [2109712]
  - configs: enable CONFIG_HP_ILO for aarch64 (Mark Salter) [2123508]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.3.1.rt7.213.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-425.3.1.rt7.213.el8 [2067251]
  - iwlwifi: limit fw version for AC9560 to avoid fw crash (Íñigo Huguet) [2129297]
  - sfc: fix null pointer dereference in efx_hard_start_xmit (Íñigo Huguet) [2119638]
  - sfc: fix TX channel offset when using legacy interrupts (Íñigo Huguet) [2119638]
  - netfilter: conntrack: reduce timeout when receiving out-of-window fin or rst (Florian Westphal) [2047366]
  - netfilter: conntrack: remove unneeded indent level (Florian Westphal) [2047366]
  - netfilter: conntrack: ignore overly delayed tcp packets (Florian Westphal) [2047366]
  - netfilter: conntrack: prepare tcp_in_window for ternary return value (Florian Westphal) [2047366]
  - netfilter: conntrack: remove pr_debug callsites from tcp tracker (Florian Westphal) [2047366]
  - netfilter: conntrack: work around exceeded receive window (Florian Westphal) [2047366]
  - netfilter: conntrack: improve RST handling when tuple is re-used (Florian Westphal) [2047366]
  - netfilter: conntrack: avoid misleading 'invalid' in log message (Florian Westphal) [2047366]
  - netfilter: remove BUG_ON() after skb_header_pointer() (Florian Westphal) [2047366]
  - iavf: Detach device during reset task (Petr Oros) [2069206]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.4.1.rt7.214.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-425.4.1.rt7.214.el8 [2067251]
  - random: allow reseeding DRBG with getrandom (Daiki Ueno) [2121766]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.5.1.rt7.215.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.5.1.rt7.215.el8_7 [2137411]
  - ice: Fix interface being down after reset with link-down-on-close flag on (Petr Oros) [2136216 2024110]
  - ice: Fix crash by keep old cfg when update TCs more than queues (Petr Oros) [2130992 2129902]
  - ice: Fix tunnel checksum offload with fragmented traffic (Petr Oros) [2130992 2129902]
  - ice: handle E822 generic device ID in PLDM header (Petr Oros) [2130992 2129902]
  - ice: ethtool: Prohibit improper channel config for DCB (Petr Oros) [2130992 2129902]
  - ice: ethtool: advertise 1000M speeds properly (Petr Oros) [2130992 2129902]
  - ice: Fix switchdev rules book keeping (Petr Oros) [2130992 2129902]
  - ice: fix access-beyond-end in the switch code (Petr Oros) [2130992 2129902]
  - eth: ice: silence the GCC 12 array-bounds warning (Petr Oros) [2130992 2129902]
  - ice: Expose RSS indirection tables for queue groups via ethtool (Petr Oros) [2130992 2129902]
  - Revert "ice: Hide bus-info in ethtool for PRs in switchdev mode" (Petr Oros) [2130992 2129902]
  - ice: remove period on argument description in ice_for_each_vf (Petr Oros) [2130992 2129902]
  - ice: add a function comment for ice_cfg_mac_antispoof (Petr Oros) [2130992 2129902]
  - ice: fix wording in comment for ice_reset_vf (Petr Oros) [2130992 2129902]
  - ice: remove return value comment for ice_reset_all_vfs (Petr Oros) [2130992 2129902]
  - ice: always check VF VSI pointer values (Petr Oros) [2130992 2129902]
  - ice: add newline to dev_dbg in ice_vf_fdir_dump_info (Petr Oros) [2130992 2129902]
  - ice: get switch id on switchdev devices (Petr Oros) [2130992 2129902]
  - ice: return ENOSPC when exceeding ICE_MAX_CHAIN_WORDS (Petr Oros) [2130992 2129902]
  - ice: introduce common helper for retrieving VSI by vsi_num (Petr Oros) [2130992 2129902]
  - ice: use min_t() to make code cleaner in ice_gnss (Petr Oros) [2130992 2129902]
  - ice: Add mpls+tso support (Petr Oros) [2130992 2129902]
  - ice: switch: convert packet template match code to rodata (Petr Oros) [2130992 2129902]
  - ice: switch: use convenience macros to declare dummy pkt templates (Petr Oros) [2130992 2129902]
  - ice: switch: use a struct to pass packet template params (Petr Oros) [2130992 2129902]
  - ice: switch: unobscurify bitops loop in ice_fill_adv_dummy_packet() (Petr Oros) [2130992 2129902]
  - ice: switch: add and use u16[] aliases to ice_adv_lkup_elem::{h, m}_u (Petr Oros) [2130992 2129902]
  - ice: Support GTP-U and GTP-C offload in switchdev (Petr Oros) [2130992 2129902]
  - ice: Remove useless DMA-32 fallback configuration (Petr Oros) [2130992 2129902]
  - ice: switch to napi_build_skb() (Petr Oros) [2130992 2129902]
  - redhat: switch to z-stream dist tag and build targets (Jarod Wilson)
  - block: avoid sign extend problem with default queue flags mask (Nico Pache) [2135813]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.6.1.rt7.216.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.6.1.rt7.216.el8_7 [2137411]
  - ice: Add low latency Tx timestamp read (Petr Oros) [2136036 2092425]
  - ice: introduce ice_ptp_reset_cached_phctime function (Petr Oros) [2136036 2092425]
  - ice: re-arrange some static functions in ice_ptp.c (Petr Oros) [2136036 2092425]
  - ice: track and warn when PHC update is late (Petr Oros) [2136036 2092425]
  - ice: track Tx timestamp stats similar to other Intel drivers (Petr Oros) [2136036 2092425]
  - ice: implement adjfine with mul_u64_u64_div_u64 (Petr Oros) [2136036 2092425]
  - ice: Add EXTTS feature to the feature bitmap (Petr Oros) [2136036 2092425]
  - math: Export mul_u64_u64_div_u64 (Petr Oros) [2136036 2092425]
  - vfio/type1: Unpin zero pages (Alex Williamson) [2128515 2123015]
  - net: atlantic: remove aq_nic_deinit() when resume (Íñigo Huguet) [2131935 2130839]
  - net: atlantic: remove deep parameter on suspend/resume functions (Íñigo Huguet) [2131935 2130839]
  - CI: Use zstream builder container (Veronika Kabatova)
  - CI: Add disttag override for 8.7 (Veronika Kabatova)


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.7.1.rt7.217.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.7.1.rt7.217.el8_7 [2137411]
  - ice: Add additional CSR registers to ETHTOOL_GREGS (Petr Oros) [2136513 2131024]
  - i40e: Fix set max_tx_rate when it is lower than 1 Mbps (Petr Oros) [2137270 2106964]
  - i40e: Fix VF set max MTU size (Petr Oros) [2137270 2106964]
  - iavf: Fix set max MTU size with port VLAN and jumbo frames (Petr Oros) [2137270 2106964]
  - iavf: Fix bad page state (Petr Oros) [2137270 2106964]
  - Revert "scsi: mpi3mr: Schedule IRQ kthreads only on non-RT kernels" (Jarod Wilson)
  - scsi: mpi3mr: Schedule IRQ kthreads only on non-RT kernels (Tomas Henzl) [2139216]
  - Revert "ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems" (Jarod Wilson)
  - ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems (Wei Huang) [2142170 2130653]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.8.1.rt7.218.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.8.1.rt7.218.el8_7 [2137411]
  - scsi: mpi3mr: Schedule IRQ kthreads only on non-RT kernels (Tomas Henzl) [2139216 2134535]
  - RDMA/mlx5: Set local port to one when accessing counters (Mohammad Kabat) [2141957 2077119]
  - drm/mgag200: Fix PLL setup for G200_SE_A rev >=4 (Jocelyn Falempe) [2140152 2130159]
  - iavf: Do not restart Tx queues after reset task failure (Petr Oros) [2149081 2134005]
  - iavf: Fix a crash during reset task (Petr Oros) [2149081 2134005]
  - scsi: core: Allow the ALUA transitioning state enough time (Tomas Henzl) [2147374 2084250]
  - scsi: core: Return BLK_STS_TRANSPORT for ALUA transitioning (Tomas Henzl) [2147374 2084250]
  - i40e: Fix DMA mappings leak (Ivan Vecera) [2138205 2077847]
  - net: usb: ax88179_178a: Fix packet receiving (Jose Ignacio Tornos Martinez) [2142724 2142725] {CVE-2022-2964}
  - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (Jose Ignacio Tornos Martinez) [2142724 2142725] {CVE-2022-2964}


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.9.1.rt7.219.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.9.1.rt7.219.el8_7 [2137411]
  - Documentation/admin-guide: Document nomodeset kernel parameter (Jocelyn Falempe) [2145218 2143952]
  - drm: Move nomodeset kernel parameter to the DRM subsystem (Jocelyn Falempe) [2145218 2143952]
  - wait: Fix __wait_event_hrtimeout for RT/DL tasks (Derek Barbosa) [2138953 2125233]
  - scsi: zfcp: Fix missing auto port scan and thus missing target ports (Tobias Huschle) [2127849 2121089]
  - net: Fix return value of qdisc ingress handling on success (Ivan Vecera) [2141878 2131361]


author: Chris White <chwhite@redhat.com> [4.18.0-425.10.1.rt7.220.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.10.1.rt7.220.el8_7 [2137411]
  - scsi: target: loop: Fix handling of aborted TMRs (Maurizio Lombardi) [2144583 2141713]
  - ice: virtchnl rss hena support (Petr Oros) [2148130]
  - ice: Fix configuring VIRTCHNL_OP_CONFIG_VSI_QUEUES with unbalanced queues (Michal Schmidt) [2142017 2137378]
  - ice: Add support Flex RXD (Michal Schmidt) [2138157 2131310]
  - netfilter: flowtable: fix stuck flows on cleanup due to pending work (Phil Sutter) [2134084 2131370]
  - netfilter: flowtable: add function to invoke garbage collection immediately (Phil Sutter) [2134084 2131370]
  - netfilter: flowtable: pass flowtable to nf_flow_table_iterate() (Phil Sutter) [2134084 2131370]
  - netfilter: flowtable: separate replace, destroy and stats to different workqueues (Phil Sutter) [2134084 2131370]
  - x86/paravirt: Add a dummy __x86_paravirt_patch_template() function (Waiman Long) [2152206 2144161]
  - x86/paravirt: Fix kABI breakage in struct pv_mmu_ops (Waiman Long) [2152206 2144161]
  - drm/i915: fix TLB invalidation for Gen12 video and compute engines (Wander Lairson Costa) [2148162 2148163] {CVE-2022-4139}
  - PCI: hv: Do not set PCI_COMMAND_MEMORY to reduce VM boot time (Emanuele Giuseppe Esposito) [2150912 2082836]
  - iavf: Fix cached head and tail value for iavf_get_tx_pending (Stefan Assmann) [2149742 2103944]
  - iavf: Fix change VF's mac address (Stefan Assmann) [2149742 2103944]
  - iavf: Fix race between iavf_close and iavf_reset_task (Stefan Assmann) [2149742 2103944]
  - net: ethernet: move from strlcpy with unused retval to strscpy (Stefan Assmann) [2149742 2103944]
  - iavf: Fix 'tc qdisc show' listing too many queues (Stefan Assmann) [2149742 2103944]
  - iavf: Fix max_rate limiting (Stefan Assmann) [2149742 2103944]
  - iavf: Check for duplicate TC flower filter before parsing (Stefan Assmann) [2149742 2103944]
  - iavf: Fix handling of dummy receive descriptors (Stefan Assmann) [2149742 2103944]
  - iavf: Disallow changing rx/tx-frames and rx/tx-frames-irq (Stefan Assmann) [2149742 2103944]
  - intel/iavf:fix repeated words in comments (Stefan Assmann) [2149742 2103944]
  - intel: remove unused macros (Stefan Assmann) [2149742 2103944]
  - iavf: Add waiting for response from PF in set mac (Stefan Assmann) [2149742 2103944]


author: Chris White <chwhite@redhat.com> [4.18.0-425.11.1.rt7.221.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.11.1.rt7.221.el8_7 [2159806]
  - NFSD: Protect against send buffer overflow in NFSv3 READ (Scott Mayhew) [2143174] {CVE-2022-43945}
  - NFSD: Protect against send buffer overflow in NFSv2 READ (Scott Mayhew) [2143174] {CVE-2022-43945}
  - NFSD: Protect against send buffer overflow in NFSv3 READDIR (Scott Mayhew) [2143174] {CVE-2022-43945}
  - NFSD: Protect against send buffer overflow in NFSv2 READDIR (Scott Mayhew) [2143174] {CVE-2022-43945}
  - SUNRPC: Fix svcxdr_init_encode's buflen calculation (Scott Mayhew) [2143174] {CVE-2022-43945}
  - SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation (Scott Mayhew) [2143174] {CVE-2022-43945}
  - panic, kexec: make __crash_kexec() NMI safe (Valentin Schneider) [2139580]
  - kexec: turn all kexec_mutex acquisitions into trylocks (Valentin Schneider) [2139580]
  - kexec: move locking into do_kexec_load (Valentin Schneider) [2139580]
  - vdpa/mlx5: re-create forwarding rules after mac modified (Laurent Vivier) [2152912]
  - timers/nohz: Last resort update jiffies on nohz_full IRQ entry (Waiman Long) [2153653]
  - irq: Call tick_irq_enter() inside HARDIRQ_OFFSET (Waiman Long) [2153653]
  - irqtime: Move irqtime entry accounting after irq offset incrementation (Waiman Long) [2153653]
  - sched/vtime: Consolidate IRQ time accounting (Waiman Long) [2153653]
  - s390/vtime: Use the generic IRQ entry accounting (Waiman Long) [2153653]
  - sched/cputime: Remove symbol exports from IRQ time accounting (Waiman Long) [2153653]
  - genirq/irqdomain: Don't try to free an interrupt that has no mapping (Waiman Long) [2153653]
  - genirq: Provide __irq_enter/exit_raw() (Waiman Long) [2153653]
  - powerpc/time: Only set CONFIG_ARCH_HAS_SCALED_CPUTIME on PPC64 (Waiman Long) [2153653]
  - powerpc/time: isolate scaled cputime accounting in dedicated functions. (Waiman Long) [2153653]
  - PCI: hv: Fix synchronization between channel callback and hv_pci_bus_exit() (Mohammed Gamal) [2155280]
  - PCI: hv: Fix synchronization between channel callback and hv_compose_msi_msg() (Mohammed Gamal) [2155280]
  - PCI: hv: Use vmbus_requestor to generate transaction IDs for VMbus hardening (Mohammed Gamal) [2155280]
  - net/mlx5e: TC, Reject forwarding from internal port to internal port (Mohammad Kabat) [2141959 2131345]
  - hv_netvsc: Fix race between VF offering and VF association message from host (Mohammed Gamal) [2155272]
  - x86/mce: Reduce number of machine checks taken during recovery (Prarit Bhargava) [2137592 2104388]
  - cgroup/cpuset: Reduce cpuset_rwsem writer latency (Waiman Long) [2153108]
  - rcu/exp: Mark current CPU as exp-QS in IPI loop second pass (Waiman Long) [2153108]
  - rcu: Always inline rcu_dynticks_task*_{enter,exit}() (Waiman Long) [2153108]
  - rcu: Fix existing exp request check in sync_sched_exp_online_cleanup() (Waiman Long) [2153108]
  - rcu: Fix macro name CONFIG_TASKS_RCU_TRACE (Waiman Long) [2153108]
  - rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock (Waiman Long) [2153108]
  - rcu: Fix to include first blocked task in stall warning (Waiman Long) [2153108]
  - cgroup: Use cgroup_attach_{lock,unlock}() from cgroup_attach_task_all() (Waiman Long) [2153108]
  - cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() (Waiman Long) [2153108]
  - cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock (Waiman Long) [2153108]
  - cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree (Waiman Long) [2153108]
  - cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug (Waiman Long) [2153108]
  - cgroup: reduce dependency on cgroup_mutex (Waiman Long) [2153108]
  - sunrpc: Set sk_allocation to GFP_NOFS to avoid using current->task_frag. (Guillaume Nault) [2153230]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.12.1.rt7.222.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.12.1.rt7.222.el8_7 [2159806]
  - x86/fpu: Prevent FPU state corruption (Oleksandr Natalenko) [2134586 2130890]
  - x86/fpu: Drop fpregs lock before inheriting FPU permissions (Eder Zulian) [2154460 2153549]
  - kernel-doc: fix undefined args variable (Jan Stancek) [2157905 2134954]
  - mm: memcontrol: fix potential oom_lock recursion deadlock (Waiman Long) [2157922 2138886]
  - memcg: prohibit unconditional exceeding the limit of dying tasks (Waiman Long) [2157922 2138886]
  - mm, oom: do not trigger out_of_memory from the #PF (Waiman Long) [2157922 2138886]
  - mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks (Waiman Long) [2157922 2138886]
  - mm: memcontrol: don't count limit-setting reclaim as memory pressure (Waiman Long) [2157922 2138886]
  - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (Thomas Huth) [2158813 2151854]
  - net: mana: Fix race on per-CQ variable napi work_done (Emanuele Giuseppe Esposito) [2155437 2151722]
  - mei: me: add adler lake point S DID (Prarit Bhargava) [2141783 2141602]
  - PCI: hv: Only reuse existing IRTE allocation for Multi-MSI (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Fix the definition of vector in hv_compose_msi_msg() (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Fix interrupt mapping for multi-MSI (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Reuse existing IRTE allocation in compose_msi_msg() (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Fix multi-MSI to allow more than one MSI vector (Emanuele Giuseppe Esposito) [2155289 2100275]
  - drm/ast: Support multiple outputs (Jarod Wilson) [2149287 2147553]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.13.1.rt7.223.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.13.1.rt7.223.el8_7 [2159806]
  - mm/cgroup/reclaim: fix dirty pages throttling on cgroup v1 (Waiman Long) [2160221]
  - mm: vmscan: remove deadlock due to throttling failing to make progress (Waiman Long) [2160221]
  - mm: vmscan: reduce throttling due to a failure to make progress -fix (Waiman Long) [2160221]
  - mm: vmscan: Reduce throttling due to a failure to make progress (Waiman Long) [2160221]
  - mm/vmscan: delay waking of tasks throttled on NOPROGRESS (Waiman Long) [2160221]
  - mm/vmscan: increase the timeout if page reclaim is not making progress (Waiman Long) [2160221]
  - mm/vmscan: centralise timeout values for reclaim_throttle (Waiman Long) [2160221]
  - mm/page_alloc: remove the throttling logic from the page allocator (Waiman Long) [2160221]
  - mm/writeback: throttle based on page writeback instead of congestion (Waiman Long) [2160221]
  - mm/vmscan: throttle reclaim when no progress is being made (Waiman Long) [2160221]
  - mm/vmscan: throttle reclaim and compaction when too may pages are isolated (Waiman Long) [2160221]
  - mm/vmscan: throttle reclaim until some writeback completes if congested (Waiman Long) [2160221]
  - mm/vmscan.c: delete or fix duplicated words (Waiman Long) [2160221]
  - mm,page_alloc: PF_WQ_WORKER threads must sleep at should_reclaim_retry() (Nico Pache) [2160221]
  - ceph: avoid putting the realm twice when decoding snaps fails (Xiubo Li) [2155797 2139881]
  - mm/mremap: hold the rmap lock in write mode when moving page table entries. (Waiman Long) [2140950] {CVE-2022-41222}
  - mm/mremap: use pmd/pud_poplulate to update page table entries (Waiman Long) [2140950] {CVE-2022-41222}
  - mm/mremap: don't enable optimized PUD move if page table levels is 2 (Waiman Long) [2140950] {CVE-2022-41222}
  - mm/mremap: convert huge PUD move to separate helper (Waiman Long) [2140950] {CVE-2022-41222}
  - mm/mremap: fix BUILD_BUG_ON() error in get_extent (Waiman Long) [2140950] {CVE-2022-41222}
  - mm/mremap.c: fix extent calculation (Waiman Long) [2140950] {CVE-2022-41222}
  - x86: mremap speedup - Enable HAVE_MOVE_PUD (Waiman Long) [2140950] {CVE-2022-41222}
  - mm: speedup mremap on 1GB or larger regions (Waiman Long) [2140950] {CVE-2022-41222}
  - mm/mremap: start addresses are properly aligned (Waiman Long) [2140950] {CVE-2022-41222}
  - mm/mremap: calculate extent in one place (Waiman Long) [2140950] {CVE-2022-41222}
  - mm/mremap: it is sure to have enough space when extent meets requirement (Waiman Long) [2140950] {CVE-2022-41222}
  - s390/boot: add secure boot trailer (Tobias Huschle) [2151530 2141967]
  - i40e: Fix VF hang when reset is triggered on another VF (Ivan Vecera) [2160460 2103801]
  - i2c: ismt: Fix an out-of-bounds bug in ismt_access() (Prarit Bhargava) [2154388 2119066] {CVE-2022-2873}
  - iavf: schedule watchdog immediately when changing primary MAC (Michal Schmidt) [2163257 2152493]
  - iavf: Move netdev_update_features() into watchdog task (Michal Schmidt) [2163257 2152493]
  - iavf: fix temporary deadlock and failure to set MAC address (Michal Schmidt) [2163257 2152493]
  - iavf: Fix error handling in iavf_init_module() (Michal Schmidt) [2163257 2152493]
  - iommu/vt-d: Clean up si_domain in the init_dmars() error path (Jerry Snitselaar) [2149474 2118428]
  - x86/pci/xen: Use msi_msg shadow structs (Jerry Snitselaar) [2149474 2118428]
  - iommu/intel: Use msi_msg shadow structs (Jerry Snitselaar) [2149474 2118428]
  - PCI: MSI: Fix Kconfig dependencies for PCI_MSI_ARCH_FALLBACKS (Jerry Snitselaar) [2149474 2118428]
  - x86/apic/msi: Unbreak DMAR and HPET MSI (Jerry Snitselaar) [2149474 2118428]
  - iommu/amd: Remove domain search for PCI/MSI (Jerry Snitselaar) [2149474 2118428]
  - iommu/vt-d: Remove domain search for PCI/MSI[X] (Jerry Snitselaar) [2149474 2118428]
  - x86/irq: Make most MSI ops XEN private (Jerry Snitselaar) [2149474 2118428]
  - x86/irq: Cleanup the arch_*_msi_irqs() leftovers (Jerry Snitselaar) [2149474 2118428]
  - PCI/MSI: Make arch_.*_msi_irq[s] fallbacks selectable (Jerry Snitselaar) [2149474 2118428]
  - x86/xen: Wrap XEN MSI management into irqdomain (Jerry Snitselaar) [2149474 2118428]
  - x86/xen: Consolidate XEN-MSI init (Jerry Snitselaar) [2149474 2118428]
  - x86/xen: Rework MSI teardown (Jerry Snitselaar) [2149474 2118428]
  - x86/xen: Make xen_msi_init() static and rename it to xen_hvm_msi_init() (Jerry Snitselaar) [2149474 2118428]
  - x86/irq: Move apic_post_init() invocation to one place (Jerry Snitselaar) [2149474 2118428]
  - x86/msi: Use generic MSI domain ops (Jerry Snitselaar) [2149474 2118428]
  - x86/msi: Remove pointless vcpu_affinity callback (Jerry Snitselaar) [2149474 2118428]
  - iommu/vt-d: Fix compile error with CONFIG_PCI_ATS not set (Myron Stowe) [2149474 2118428]
  - iommu/vt-d: Cure VF irqdomain hickup (Myron Stowe) [2149474 2118428]
  - x86/pci: Set default irq domain in pcibios_add_device() (Myron Stowe) [2149474 2118428]
  - iommm/amd: Store irq domain in struct device (Myron Stowe) [2149474 2118428]
  - iommm/vt-d: Store irq domain in struct device (Myron Stowe) [2149474 2118428]
  - PCI/MSI: Provide pci_dev_has_special_msi_domain() helper (Myron Stowe) [2149474 2118428]
  - x86/msi: Consolidate MSI allocation (Myron Stowe) [2149474 2118428]
  - PCI/MSI: Rework pci_msi_domain_calc_hwirq() (Myron Stowe) [2149474 2118428]
  - x86/irq: Consolidate UV domain allocation (Myron Stowe) [2149474 2118428]
  - x86/irq: Consolidate DMAR irq allocation (Myron Stowe) [2149474 2118428]
  - x86_ioapic_Consolidate_IOAPIC_allocation (Myron Stowe) [2149474 2118428]
  - x86/msi: Consolidate HPET allocation (Myron Stowe) [2149474 2118428]
  - iommu/irq_remapping: Consolidate irq domain lookup (Myron Stowe) [2149474 2118428]
  - iommu/amd: Consolidate irq domain getter (Myron Stowe) [2149474 2118428]
  - iommu/vt-d: Consolidate irq domain getter (Myron Stowe) [2149474 2118428]
  - x86/irq: Add allocation type for parent domain retrieval (Myron Stowe) [2149474 2118428]
  - irqdomain: Export irq_domain_update_bus_token (Myron Stowe) [2149474 2118428]
  - gitlab-ci: use CI templates from production branch (Michael Hofmann)
  - iavf: remove INITIAL_MAC_SET to allow gARP to work properly (Stefan Assmann) [2149745 1938635]
  - Revert "scsi: iscsi: ql4xxx: Use per-session workqueue for unbinding" (Chris Leech) [2152734 2122624]
  - Revert "scsi: iscsi: Use the session workqueue for recovery" (Chris Leech) [2152734 2122624]
  - arm64/bpf: Remove 128MB limit for BPF JIT programs (Yauheni Kaliuta) [2152138 2140163]
  - bpf: Define bpf_jit_alloc_exec_limit for arm64 JIT (Yauheni Kaliuta) [2152138 2140163]
  - arm64: extable: add `type` and `data` fields (Yauheni Kaliuta) [2152138 2140163]
  - arm64: extable: use `ex` for `exception_table_entry` (Yauheni Kaliuta) [2152138 2140163]
  - arm64: extable: make fixup_exception() return bool (Yauheni Kaliuta) [2152138 2140163]
  - arm64: extable: consolidate definitions (Yauheni Kaliuta) [2152138 2140163]
  - arm64: kvm: use kvm_exception_table_entry (Yauheni Kaliuta) [2152138 2140163]
  - be2net: Fix buffer overflow in be_get_module_eeprom (Josef Oskera) [2160182 2126917]
  - sched: Switch to upstream migrate disable code (Crystal Wood) [2132062]
  - tick: Fix timer storm since introduction of timersd (Valentin Schneider) [2127204]
  - softirq: Use a dedicated thread for timer wakeups. (Valentin Schneider) [2127204]


author: Chris White <chwhite@redhat.com> [4.18.0-425.11.1.rt7.221.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.11.1.rt7.221.el8_7 [2159806]
  - NFSD: Protect against send buffer overflow in NFSv3 READ (Scott Mayhew) [2143174] {CVE-2022-43945}
  - NFSD: Protect against send buffer overflow in NFSv2 READ (Scott Mayhew) [2143174] {CVE-2022-43945}
  - NFSD: Protect against send buffer overflow in NFSv3 READDIR (Scott Mayhew) [2143174] {CVE-2022-43945}
  - NFSD: Protect against send buffer overflow in NFSv2 READDIR (Scott Mayhew) [2143174] {CVE-2022-43945}
  - SUNRPC: Fix svcxdr_init_encode's buflen calculation (Scott Mayhew) [2143174] {CVE-2022-43945}
  - SUNRPC: Fix svcxdr_init_decode's end-of-buffer calculation (Scott Mayhew) [2143174] {CVE-2022-43945}
  - panic, kexec: make __crash_kexec() NMI safe (Valentin Schneider) [2139851]
  - kexec: turn all kexec_mutex acquisitions into trylocks (Valentin Schneider) [2139580]
  - kexec: move locking into do_kexec_load (Valentin Schneider) [2139580]
  - vdpa/mlx5: re-create forwarding rules after mac modified (Laurent Vivier) [2152912]
  - timers/nohz: Last resort update jiffies on nohz_full IRQ entry (Waiman Long) [2153653]
  - irq: Call tick_irq_enter() inside HARDIRQ_OFFSET (Waiman Long) [2153653]
  - irqtime: Move irqtime entry accounting after irq offset incrementation (Waiman Long) [2153653]
  - sched/vtime: Consolidate IRQ time accounting (Waiman Long) [2153653]
  - s390/vtime: Use the generic IRQ entry accounting (Waiman Long) [2153653]
  - sched/cputime: Remove symbol exports from IRQ time accounting (Waiman Long) [2153653]
  - genirq/irqdomain: Don't try to free an interrupt that has no mapping (Waiman Long) [2153653]
  - genirq: Provide __irq_enter/exit_raw() (Waiman Long) [2153653]
  - powerpc/time: Only set CONFIG_ARCH_HAS_SCALED_CPUTIME on PPC64 (Waiman Long) [2153653]
  - powerpc/time: isolate scaled cputime accounting in dedicated functions. (Waiman Long) [2153653]
  - PCI: hv: Fix synchronization between channel callback and hv_pci_bus_exit() (Mohammed Gamal) [2155280]
  - PCI: hv: Fix synchronization between channel callback and hv_compose_msi_msg() (Mohammed Gamal) [2155280]
  - PCI: hv: Use vmbus_requestor to generate transaction IDs for VMbus hardening (Mohammed Gamal) [2155280]
  - net/mlx5e: TC, Reject forwarding from internal port to internal port (Mohammad Kabat) [2141959 2131345]
  - hv_netvsc: Fix race between VF offering and VF association message from host (Mohammed Gamal) [2155272]
  - x86/mce: Reduce number of machine checks taken during recovery (Prarit Bhargava) [2137592 2104388]
  - cgroup/cpuset: Reduce cpuset_rwsem writer latency (Waiman Long) [2153108]
  - rcu/exp: Mark current CPU as exp-QS in IPI loop second pass (Waiman Long) [2153108]
  - rcu: Always inline rcu_dynticks_task*_{enter,exit}() (Waiman Long) [2153108]
  - rcu: Fix existing exp request check in sync_sched_exp_online_cleanup() (Waiman Long) [2153108]
  - rcu: Fix macro name CONFIG_TASKS_RCU_TRACE (Waiman Long) [2153108]
  - rcu: Fix stall-warning deadlock due to non-release of rcu_node ->lock (Waiman Long) [2153108]
  - rcu: Fix to include first blocked task in stall warning (Waiman Long) [2153108]
  - cgroup: Use cgroup_attach_{lock,unlock}() from cgroup_attach_task_all() (Waiman Long) [2153108]
  - cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all() (Waiman Long) [2153108]
  - cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock (Waiman Long) [2153108]
  - cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree (Waiman Long) [2153108]
  - cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug (Waiman Long) [2153108]
  - cgroup: reduce dependency on cgroup_mutex (Waiman Long) [2153108]
  - sunrpc: Set sk_allocation to GFP_NOFS to avoid using current->task_frag. (Guillaume Nault) [2153230]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.12.1.rt7.222.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.12.1.rt7.222.el8_7 [2159806]
  - x86/fpu: Prevent FPU state corruption (Oleksandr Natalenko) [2134586 2130890]
  - x86/fpu: Drop fpregs lock before inheriting FPU permissions (Eder Zulian) [2154469 2153549]
  - kernel-doc: fix undefined args variable (Jan Stancek) [2157905 2134954]
  - mm: memcontrol: fix potential oom_lock recursion deadlock (Waiman Long) [2157922 2138886]
  - memcg: prohibit unconditional exceeding the limit of dying tasks (Waiman Long) [2157922 2138886]
  - mm, oom: do not trigger out_of_memory from the #PF (Waiman Long) [2157922 2138886]
  - mm, oom: pagefault_out_of_memory: don't force global OOM for dying tasks (Waiman Long) [2157922 2138886]
  - mm: memcontrol: don't count limit-setting reclaim as memory pressure (Waiman Long) [2157922 2138886]
  - KVM: s390: vsie: Fix the initialization of the epoch extension (epdx) field (Thomas Huth) [2158813 2151854]
  - net: mana: Fix race on per-CQ variable napi work_done (Emanuele Giuseppe Esposito) [2155437 2151722]
  - mei: me: add adler lake point S DID (Prarit Bhargava) [2141783 2141602]
  - PCI: hv: Only reuse existing IRTE allocation for Multi-MSI (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Fix the definition of vector in hv_compose_msi_msg() (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Fix interrupt mapping for multi-MSI (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Reuse existing IRTE allocation in compose_msi_msg() (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI (Emanuele Giuseppe Esposito) [2155289 2100275]
  - PCI: hv: Fix multi-MSI to allow more than one MSI vector (Emanuele Giuseppe Esposito) [2155289 2100275]
  - drm/ast: Support multiple outputs (Jarod Wilson) [2149287 2147553]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.14.1.rt7.224.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.14.1.rt7.224.el8_7 [2172278]
  - ACPI: processor idle: Practically limit "Dummy wait" workaround to old Intel systems (Wei Huang) [2142170 2130653]
  - KVM: x86: nSVM: implement nested LBR virtualization (Emanuele Giuseppe Esposito) [2166362 2155149]
  - KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running (Emanuele Giuseppe Esposito) [2166362 2155149]
  - kvm: x86: SVM: use vmcb* instead of svm->vmcb where it makes sense (Emanuele Giuseppe Esposito) [2166362 2155149]
  - KVM: x86: nSVM: implement nested VMLOAD/VMSAVE (Emanuele Giuseppe Esposito) [2166362 2155149]
  - IB/iser: Fix login with authentication (Kamal Heib) [2161750 2120676]
  - act_mirred: use the backlog for nested calls to mirred ingress (Davide Caratti) [2164648 2131339] {CVE-2022-4269}
  - net/sched: act_mirred: better wording on protection against excessive stack growth (Davide Caratti) [2164648 2131339] {CVE-2022-4269}
  - redhat/configs: Set CONFIG_X86_AMD_PSTATE to 'm' (Prarit Bhargava) [2151275 2145246]
  - KVM: x86: smm: preserve interrupt shadow in SMRAM (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: SVM: don't save SVM state to SMRAM when VM is not long mode capable (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: SVM: use smram structs (Maxim Levitsky) [2166368 2097144]
  - KVM: svm: drop explicit return value of kvm_vcpu_map (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: smm: use smram struct for 64 bit smram load/restore (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: smm: use smram struct for 32 bit smram load/restore (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: smm: use smram structs in the common code (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: smm: add structs for KVM's smram layout (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: smm: check for failures on smm entry (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: do not go through ctxt->ops when emulating rsm (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: move SMM exit to a new file (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: move SMM entry to a new file (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: start moving SMM-related functions to new files (Maxim Levitsky) [2166368 2097144]
  - bug: introduce ASSERT_STRUCT_OFFSET (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: Rename and expose helper to detect if INIT/SIPI are allowed (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: emulator: update the emulation mode after CR0 write (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: emulator: update the emulation mode after rsm (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: emulator: introduce emulator_recalc_and_set_mode (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: emulator: em_sysexit should update ctxt->mode (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: Bug the VM if the emulator accesses a non-existent GPR (Maxim Levitsky) [2166368 2097144]
  - \KVM: x86: Reduce the number of emulator GPRs to '8' for 32-bit KVM (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: Use 16-bit fields to track dirty/valid emulator GPRs (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: Omit VCPU_REGS_RIP from emulator's _regs array (Maxim Levitsky) [2166368 2097144]
  - \KVM: x86: Harden _regs accesses to guard against buggy input (Maxim Levitsky) [2166368 2097144]
  - KVM: x86: Grab regs_dirty in local 'unsigned long' (Maxim Levitsky) [2166368 2097144]
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Wander Lairson Costa) [2152577 2152578] {CVE-2022-4378}
  - proc: avoid integer type confusion in get_proc_long (Wander Lairson Costa) [2152577 2152578] {CVE-2022-4378}


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.15.1.rt7.225.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.15.1.rt7.225.el8_7 [2172278]
  - net/mlx5e: Fix use-after-free when reverting termination table (Amir Tzin) [2167640 2112927]
  - net/mlx5: Do not query pci info while pci disabled (Amir Tzin) [2167645 2129249]
  - x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly (Dean Nelson) [2168384 2122850]
  - x86/fpu: Exclude dynamic states from init_fpstate (Dean Nelson) [2168384 2122850]
  - x86/fpu: Fix the init_fpstate size check with the actual size (Dean Nelson) [2168384 2122850]
  - x86/fpu: Configure init_fpstate attributes orderly (Dean Nelson) [2168384 2122850]
  - x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation (Dean Nelson) [2168384 2122850]
  - net/mlx5: E-Switch, properly handle ingress tagged packets on VST (Amir Tzin) [2166665 2096109]
  - cpuhotplug: Fix KABI breakage (Prarit Bhargava) [2162763 2156529]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.16.1.rt7.226.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.16.1.rt7.226.el8_7 [2172278]
  - ipv6: fix panic when fib_lookup_arg->result is fib6_info (Jiri Benc) [2167602 2140599]
  - ceph: blocklist the kclient when receiving corrupted snap trace (Xiubo Li) [2168896 2162414]
  - ceph: move mount state enum to super.h (Xiubo Li) [2168896 2162414]
  - s390/kexec: fix ipl report address for kdump (Tobias Huschle) [2166296 2161328]
  - mm, compaction: fix fast_isolate_around() to stay within boundaries (Daniel Vacek) [2170576 2149309]
  - scsi: storvsc: Fix swiotlb bounce buffer leak in confidential VM (Emanuele Giuseppe Esposito) [2170228 2150659]
  - netfilter: conntrack: handle tcp challenge acks during connection reuse (Florian Westphal) [2165587 2158726]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.17.1.rt7.227.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.17.1.rt7.227.el8_7 [2172278]
  - net: mana: Add rmb after checking owner bits (Mohammed Gamal) [2173103 2139462]
  - net: mana: Add support of XDP_REDIRECT action (Mohammed Gamal) [2173103 2139462]
  - net: mana: Add the Linux MANA PF driver (Mohammed Gamal) [2173103 2139462]
  - ice: fix lost multicast packets in promisc mode (Ken Cox) [2172550 2138215]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.18.1.rt7.228.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.18.1.rt7.228.el8_7 [2172278]
  - futex: Resend potentially swallowed owner death notification (Rafael Aquini) [2170054]
  - irq_work: Move lazy work execution to dedicated irq_work kthreads (Valentin Schneider) [2172163]
  - irq_work: Sync the patches (Valentin Schneider) [2172163]
  - irq_work: Also rcuwait for !IRQ_WORK_HARD_IRQ on PREEMPT_RT (Valentin Schneider) [2172163]
  - irq_work: Allow irq_work_sync() to sleep if irq_work() no IRQ support. (Valentin Schneider) [2172163]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.19.1.rt7.229.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.19.1.rt7.229.el8_7 [2172278]
  - s390/dasd: fix no record found for raw_track_access (Tobias Huschle) [2167776 2161270]
  - locking/rwsem: Disable preemption in all down_read*() and up_read() code paths (Waiman Long) [2170939 2162139]
  - locking/rwsem: Prevent non-first waiter from spinning in down_write() slowpath (Waiman Long) [2170939 2162139]
  - locking/rwsem: Allow slowpath writer to ignore handoff bit if not set by first waiter (Waiman Long) [2170939 2162139]
  - locking/rwsem: Always try to wake waiters in out_nolock path (Waiman Long) [2170939 2162139]
  - locking/rwsem: No need to check for handoff bit if wait queue empty (Waiman Long) [2170939 2162139]
  - locking/rwsem: Make handoff bit handling more consistent (Waiman Long) [2170939 2162139]
  - locking/rwsem: Disable preemption while trying for rwsem lock (Waiman Long) [2170939 2162139]
  - locking/rwsem: Conditionally wake waiters in reader/writer slowpaths (Waiman Long) [2170939 2162139]
  - locking: Make owner_on_cpu() into <linux/sched.h> (Waiman Long) [2170939 2162139]
  - locking/rwsem: Optimize down_read_trylock() under highly contended case (Waiman Long) [2170939 2162139]
  - locking/rwsem: Fix comments about reader optimistic lock stealing conditions (Waiman Long) [2170939 2162139]
  - locking/rwsem: Disable preemption for spinning region (Waiman Long) [2170939 2162139]
  - locking: Remove rcu_read_{,un}lock() for preempt_{dis,en}able() (Waiman Long) [2170939 2162139]
  - watchdog: fix UAF in reboot notifier handling in watchdog core code (Wander Lairson Costa) [2139770 2131308]
  - netfilter: nf_conntrack_irc: Tighten matching on DCC message (Wander Lairson Costa) [2139770 2131308]
  - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (Jaroslav Kysela) [2163405 2163406] {CVE-2023-0266}
  - net/mlx5e: Fix enabling sriov while tc nic rules are offloaded (Amir Tzin) [2167647 2112925]
  - net/mlx5: E-Switch, pair only capable devices (Amir Tzin) [2167647 2112925]
  - net/mlx5: Fix mlx5_get_next_dev() peer device matching (Amir Tzin) [2167647 2112925]
  - net/mlx5: Lag, filter non compatible devices (Amir Tzin) [2167647 2112925]


author: Jarod Wilson <jarod@redhat.com> [4.18.0-425.19.2.rt7.230.el8_7]
changelog:
  - [rt] build kernel-rt-4.18.0-425.19.2.rt7.230.el8_7.geb93 [2172278]
  - ovl: fail on invalid uid/gid mapping at copy up (Miklos Szeredi) [2165341 2165342] {CVE-2023-0386}


author: Petr Stodulka <pstodulk@redhat.com> - 0.10.0-1
changelog:
  - Rebase to v0.10.0
  - Add the --enablerepo option for Leapp to use an existing custom yum/dnf
    repository during the upgrade
  - Add the --no-rhsm option for Leapp for use without subscription-manager
    (#622)
  - Add `leapp answer` to answer Dialog questions in CLI (#592)
  - Add `stdin` and `encoding` parameters in the run function (#583, #595)
  - Add new dependency on python-requests
  - Add the DESKTOP tag for the leapp report (#612)
  - Display a warning when leapp is used in an unsupported (devel/testing) mode
    (#577)
  - Drop dependency on python-jinja2
  - Error messages are now part of the preupgrade report
  - Fix json export capabilities using serialization (#598)
  - Introduce DialogModel that could be processed by actors to add related
    information into the report (#589)
  - Introduce Workflow API (#618)
  - Move all leapp and snactor files into related rpms instead of python2-leapp
    (#591)
  - Print errors on stdout in pretty format (#593)
  - Report inhibitors separately from errors on stdout (#620)
  - Show progress in non-verbose executions (#621)
  - The verbosity options (--verbose | --debug) are available for leapp commands
    as well
  - Resolves: #1821712


author: Michal Bocek <mbocek@redhat.com> - 0.11.0-1
changelog:
  - Rebase to v0.11.0
  - Bump leapp-framework capability to 1.3
  - Preserve verbose/debug options during the whole upgrade workflow
  - Print the informative error block to the STDOUT instead of STDERR
  - Add new reporting tags: `PUBLIC_CLOUD` and `RHUI`
  - Add the possibility to skip actor discovery to improve performance of tests when an actor context is injected directly
  - Introduce the `deprecated` and `suppress_deprecation` decorators to support the deprecation process
  - Store dialog answers in the leapp.db
  - Update and improve man pages
  - Raising a missing exception with tests failing under py3
  - Adde the --actor-config option to `snactor run` to specify a workflow configuration model that should be consumed by actors
  - The `call` function has been improved to be working on MacOS
  - Known issue: the `suppress_deprecation` decorator causes a traceback in certain cases


author: Dominik Rehak <drehak@redhat.com> - 0.11.1-1
changelog:
  - Rebase to v0.11.1
  - Fix conversion of deprecation messages to reports
  - Fix various issues regarding suppressing of deprecation
  - Remove pytest residuals in spec file
  - Update documentation and manpages
  - Resolves: #1887913


author: Dominik Rehak <drehak@redhat.com> - 0.12.0-1
changelog:
  - Rebase to v0.12.0
  - Bump leapp-framework capability to 1.4
  - Add JSON schema of leapp reports for validation
  - Add a stable report identifier for each generated report
  - Resolves: #1915508


author: Petr Stodulka <pstodulk@redhat.com> - 0.12.1-1
changelog:
  - Rebase to v0.12.1
  - Added rerun command for experimental purposes to be able to re-run manually
    the last phase when needed (experimental)
  - Resolves: #1952885


author: Petr Stodulka <pstodulk@redhat.com> - 0.13.0-10
changelog:
  - Rebase to v0.13.0
  - Bump the provided leapp-framework capability to 2.0
  - The commands for the leapp tool (e.g. preupgrade, upgrade) are now
    defined in the leapp-repository component
  - The leapp tool scans the available CLI commands dynamically
  - First build for the IPU 8 -> 9
  - Resolves: #1997075


author: Petr Stodulka <pstodulk@redhat.com> - 0.14.0-1
changelog:
  - Rebase to v0.14.0
  - Bump leapp-framework to 2.2
  - Bump leapp-framework-dependencies to 5
  - Add depency on python3 (distribution python)
  - Added possibility to specify the report format version
  - Check the answerfile upon loading and prevent creation of invalid answerfile
  - Dialogs: print the reason field for question in the answerfile
  - Fix the JSON serialization in Dialogs on Python3
  - Introduced new functions in the leapp standard library
  - Updated man page
  - Resolves: rhbz#1997075


author: Petr Stodulka <pstodulk@redhat.com> - 0.15.0-1
changelog:
  - Rebase to v0.15.0
  - Bump leapp-framework to 3.1
  - Deprecate `reporting.(Tags|Flags)` replaced by `reporting.Groups`
  - Fix crashes when processing invalid FQDNs
  - Fix the error msg when a leapp CLI command does not exist
  - Introduce new report JSON schema v1.2.0 (default: 1.1.0)
  - Resolves: rhbz#2090992, rhbz#2106065


author: Petr Stodulka <pstodulk@redhat.com> - 0.15.0-1.1
changelog:
  - Rebase to v0.15.0
  - Bump leapp-framework to 3.1
  - Deprecate `reporting.(Tags|Flags)` replaced by `reporting.Groups`
  - Fix crashes when processing invalid FQDNs
  - Fix the error msg when a leapp CLI command does not exist
  - Introduce new report JSON schema v1.2.0 (default: 1.1.0)
  - Fix the check of missing required answers
  - Resolves: rhbz#2125285


author: Petr Stodulka <pstodulk@redhat.com> - 0.15.0-10
changelog:
  - Bumping the release for the testing purposes.
  - First build for the IPU 8 -> 9
  - Resolves: #1997076


author: Petr Stodulka <pstodulk@redhat.com> - 0.16.0-1
changelog:
  - Rebase to v0.16.0
  - Improve the performance of the leapp execution for "pre first reboot" phases
  - Introduce upgrades for RHEL 8 to RHEL 9
  - Enabled upgrade paths:
    - RHEL 8.6 -> 9.0
    - RHEL with SAP 8.6 -> 9.0
  - Requires leapp-framework >= 2.2
  - Bump leapp-framework-dependencies to 5
  - Add actors for MariaDB and PostgreSQL
  - Add detection of enabled DNF plugins
  - Add scan & checks for VDO devices
  - Bind the /run/lock dir into the container in the upgrade initramfs env
  - Check Firewalld configuration
  - Check SSSD configuration for changes in RHEL 9
  - Check deprecated network settings
  - Check ifcfg files for change in RHEL 9
  - Check the existence of the custom network-scripts
  - Filter out PES data unrelated for the particular IPU path
  - Fix generating of instructions/data for the leapp DNF plugin during
  - Fix generating the target initramfs when additional files and dracut modules are requested to be added
  - Fix getting device attribute through udev on Python 3
  - Fix parsing of sysctl output during the scan of the system
  - Fix scanning "/etc/default/grub" with empty lines
  - Fix scanning information about mounted devices
  - Fix the execution order for the dnf dry run actor
  - Handle SELinux during the in-place upgrade
  - Handle live kernel patching during
  - Improve and generalize checking of device drivers
  - Inhibit the upgrade when ipa-server is detected
  - Introduce DNFWorkarounds to register scripts to be executed before DNF run
  - Introduce handling of DNF modularity during the upgrade
  - Introduce the --report-schema option to control the version of the generated report format
  - Introduce the --target option to specify the version of the target system
  - Provide the LEAPP_IPU_IN_PROGRESS environment variable for actors during in-place upgrade
  - Resolves: #1997076


author: Petr Stodulka <pstodulk@redhat.com> - 0.16.0-4
changelog:
  - Extend the check of deprecated or removed PCI drivers
  - Do not instruct DNF to install rubygem-irb during the in-place upgrade
    to prevent conflict between files
  - Resolves: #1997076


author: Petr Stodulka <pstodulk@redhat.com> - 0.17.0-1
changelog:
  - Rebase to v0.17.0
  - Support upgrade path RHEL 8.7 -> 9.0 and RHEL SAP 8.6 -> 9.0
  - Provide and require leapp-repository-dependencies 7
  - Provide `leapp-command(<CMD>)` for each CLI command provided by leapp-repository
  - Require dracut, kmod, procps-ng on RHEL 8+
  - Require leapp-framework >= 3.1
  - Add actors covering removal of NIS components on RHEL 9
  - Add checks for obsolete .NET versions
  - Allow specifying the report schema v1.2.0
  - Check and handle upgrades with custom crypto policies
  - Check and migrate OpenSSH configuration
  - Check and migrate multipath configuration
  - Check minimum memory requirements
  - Do not create the upgrade bootloader entry when the dnf dry-run actor stops the upgrade
  - Enable Base and SAP in-place upgrades on Azure
  - Enable in-place upgrade in case LUKS volumes are Ceph OSDs
  - Enable in-place upgrades in Azure RHEL 8 base images using RHUI
  - Enable in-place upgrades on  IBM z16 machines
  - Enable the CRB repository for the upgrade only if enabled on the source system
  - Fix cloud provider detection on AWS
  - Fix detection of the latest kernel
  - Fix issues caused by leapp artifacts from previous in-place upgrades
  - Fix issues with false positive switch to emergency console during the upgrade
  - Fix swap page size on aarch64
  - Fix the VDO scanner to skip partitions unrelated to VDO and adjust error messages
  - Fix the false positive NFS storage detection on NFS servers and improve the report msg
  - Fix the issues on systems with the LANGUAGE environment variable
  - Fix the root directory scan to deal with non-utf8 filenames
  - Handle upgrades of SAP systems on AWS
  - Inform about necessary migrations related to bacula-director when installed on the system
  - Inhibit the upgrade when /var/lib/leapp being mounted in a non-persistent fashion to prevent failures
  - Inhibit the upgrade when /var/lib/leapp mounted with the noexec option to prevent failures
  - Inhibit upgrade when NVIDIA driver is detected
  - Make the application of custom selinux rules more reliable and do not override changes done by RPM scriptlets
  - Migrate the OpenSSL configuration
  - PESEventScanner actor has been fully refactored
  - Report changes around SCP and SFTP
  - Skip comment lines when parsing the GRUB configuration file
  - Stop propagating the “debug” and ”enforcing=0” kernel cmdline options into the target kernel cmdline options
  - Mass refactoring to be compatible with leapp v0.15.0
  - Resolves: rhbz#2090995, rhbz#2040470, rhbz#2092005, rhbz#2093220, rhbz#2095704, rhbz#2096159, rhbz#2100108, rhbz#2100110, rhbz#2103282, rhbz#2106904, rhbz#2110627


author: Petr Stodulka <pstodulk@redhat.com> - 0.17.0-1.1
changelog:
  - Rebase to v0.17.0
  - Support upgrade path RHEL 8.7 -> 9.0 and RHEL SAP 8.6 -> 9.0
  - Provide and require leapp-repository-dependencies 7
  - Provide `leapp-command(<CMD>)` for each CLI command provided by leapp-repository
  - Require dracut, kmod, procps-ng on RHEL 8+
  - Require leapp-framework >= 3.1
  - Add actors covering removal of NIS components on RHEL 9
  - Add checks for obsolete .NET versions
  - Allow specifying the report schema v1.2.0
  - Check and handle upgrades with custom crypto policies
  - Check and migrate OpenSSH configuration
  - Check and migrate multipath configuration
  - Check minimum memory requirements
  - Do not create the upgrade bootloader entry when the dnf dry-run actor stops the upgrade
  - Enable Base and SAP in-place upgrades on Azure
  - Enable in-place upgrade in case LUKS volumes are Ceph OSDs
  - Enable in-place upgrades in Azure RHEL 8 base images using RHUI
  - Enable in-place upgrades on  IBM z16 machines
  - Enable the CRB repository for the upgrade only if enabled on the source system
  - Fix cloud provider detection on AWS
  - Fix detection of the latest kernel
  - Fix issues caused by leapp artifacts from previous in-place upgrades
  - Fix issues with false positive switch to emergency console during the upgrade
  - Fix swap page size on aarch64
  - Fix the VDO scanner to skip partitions unrelated to VDO and adjust error messages
  - Fix the false positive NFS storage detection on NFS servers and improve the report msg
  - Fix the issues on systems with the LANGUAGE environment variable
  - Fix the root directory scan to deal with non-utf8 filenames
  - Handle upgrades of SAP systems on AWS
  - Inform about necessary migrations related to bacula-director when installed on the system
  - Inhibit the upgrade when /var/lib/leapp being mounted in a non-persistent fashion to prevent failures
  - Inhibit the upgrade when /var/lib/leapp mounted with the noexec option to prevent failures
  - Inhibit upgrade when NVIDIA driver is detected
  - Make the application of custom selinux rules more reliable and do not override changes done by RPM scriptlets
  - Migrate the OpenSSL configuration
  - PESEventScanner actor has been fully refactored
  - Report changes around SCP and SFTP
  - Skip comment lines when parsing the GRUB configuration file
  - Stop propagating the “debug” and ”enforcing=0” kernel cmdline options into the target kernel cmdline options
  - Mass refactoring to be compatible with leapp v0.15.0
  - Update VDO checks to enable user to decide the system state on check failures
    and undetermined block devices
  - The VDO dialog and related VDO reports have been properly updated
  - Resolves: rhbz#2125284


author: Petr Stodulka <pstodulk@redhat.com> - 0.17.0-1.2
changelog:
  - Add checks for the in-place upgrades of RHEL for SAP
  - RHUI: Fix the in-place upgrade on Azure for RHEL SAP Applications
  - Resolves: rhbz#2125284


author: Peter Hutterer <peter.hutterer@redhat.com> - 3.5.12-9
changelog:
  - Fix CVE-2022-46285: infinite loop on unclosed comments (#2161800)
  - Fix CVE-2022-44617: runaway loop with width of 0 (#2161808)
  - Fix CVE-2022-4883: compression depends on $PATH (#2160238)


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.3-11
changelog:
  Correctly set socket directory permissions when
    qb_ipcs_connection_auth_set() is called
    Resolves: rhbz#1836146


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-6
changelog:
  - Resolves: rhbz#1980800 allow convert to csv to write each sheet to
    separate file
  - Resolves: rhbz#1992695 two style tags where there should be one


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-7
changelog:
  - Resolves: rhbz#2013858 CVE-2021-25633
  - Resolves: rhbz#2014215 CVE-2021-25634
  - Resolves: rhbz#2014209 CVE-2021-25635


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-9
changelog:
  - Related: rhbz#2029810 set NoDisplay=true for .desktop on s390x/aarch64
  - Related: rhbz#2029810 don't Require any vclplug for s390x/aarch64


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-12
changelog:
  - Resolves: rhbz#2134752 CVE-2022-26305 Untrusted Macros
  - Resolves: rhbz#2134751 CVE-2022-26307 Weak Master Keys
  - Resolves: rhbz#2134750 CVE-2022-26306 Static Initialization Vector
  - Resolves: rhbz#2134753 CVE-2022-3140 Macro URL arbitrary script execution


author: Paul Wouters <pwouters@redhat.com> - 4.1-1
changelog:
  - Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.1
  - Resolves: rhbz#1889836 libreswan: add 3.x compat patches for obsoleted/removed keywords of 4.0 and re-port ikev2= patch


author: Paul Wouters <pwouters@redhat.com> - 4.2-1
changelog:
  - Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.2
  - Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec


author: Paul Wouters <pwouters@redhat.com> - 4.3-3
changelog:
  - Resolves: rhbz#1933064 - IKEv2 support for Labeled IPsec
  - Resolves: rhbz#1935150 RFE: Support IKE and ESP over TCP: RFC 8229
  - Resolves: rhbz#1935339 virtual_private setting is missing in the default config


author: Daiki Ueno <dueno@redhat.com> - 4.4-1
changelog:
  - Resolves: rhbz#1958968 Rebase libreswan to 4.4
  - Resolves: rhbz#1954423 Libreswan: TS_UNACCEPTABLE on multiple connections between the same peers


author: Daiki Ueno <dueno@redhat.com> - 4.5-1
changelog:
  - Resolves: rhbz#2017352 Rebase libreswan to 4.5
  - Resolves: rhbz#2036903 ikev1: disable diagnostics logging on receiving malformed packets


author: Jindrich Novy <jnovy@redhat.com> - 4.3.0-3
changelog:
  - fix static analysis issues merged upstream
    (https://gitlab.freedesktop.org/slirp/libslirp/-/merge_requests/41)
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 4.3.0-4
changelog:
  - fix "CVE-2020-10756 QEMU: slirp: networking out-of-bounds read information disclosure vulnerability"
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 4.4.0-1
changelog:
  - Fix CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 out-of-bounds access
  - Related: #1934415


author: Ales Matej <amatej@redhat.org> - 0.7.11-1
changelog:
  - Update to 0.7.11
  - selected bug fixes:
    * support arch<->noarch package changes when creating patch
      conflicts from the updateinfo data
    * also support other rpm database types
    * fixed solv_zchunk decoding error if large chunks are used
    * treat retracted pathes as irrelevant
    * made add_update_target work with multiversion installs
  - new features
    * support for SOLVER_BLACKLIST jobs that block the installation of matched
      packages unless they are directly selected by an SOLVER_INSTALL job
    * libsolv now also parses the patch status in the updateinfo parser
    * new solvable_matchessolvable() function
    * support conda constrains dependencies
    * new rpm_stat_database() function
    * new rpm_hash_database_state() function


author: Nicola Sella <nsella@redhat.com> - 0.7.16-1
changelog:
  - Update to 0.7.16
  - selected bug fixes:
    * make testcase_mangle_repo_names deal correctly with freed repos
    [bnc#1177238]
    * fix add_complex_recommends() selecting conflicted packages in
      rare cases leading to crashes
    * improve choicerule generation so that package updates are
      prefered in more cases
    * fix deduceq2addedmap clearing bits outside of the map
    * conda: feature depriorization and fix startswith implementation
    * Fix solvable swapping messing up idarrays
    * fix ruleinfo of complex dependencies returning the wrong origin
    * fix solv_zchunk decoding error if large chunks are used
      [bnc#1159314]
  - new features
    * new testcase_mangle_repo_names() function
    * new solv_fmemopen() function
    * Enable zstd compression support for sle15 and sle15-sp2
    * Support blacklisted packages in solver_findproblemrule()
      [bnc#1172135]
    * Support rules with multiple negative literals in choice rule
      generation
    * build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
      multiple rpm database backends
    * added two new function to make libzypp independent of the rpm
      database format
    * support conda constrains dependencies


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.17-1
changelog:
  - Update to 0.7.17
  - selected bug fixes:
    * repo_write: fix handling of nested flexarray
    * improve choicerule generation a bit more to cover more cases
    * harden testcase parser against repos being added too late
    * support python-3.10
    * check /var/lib/rpm macro in rpmdb code
  - new features:
    * handle default/visible/langonly attributes in comps parser
    * support multiple collections in updateinfo parser
    * add '-D' option in rpmdb2solv to set the dbpath


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.19-1
changelog:
  - Update to 0.7.19
  - repo_add_conda: add flag to skip v2 packages
  - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt
  - fix error handling in solv_xfopen_fd()
  - fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Peter Robinson <pbrobinson@fedoraproject.org> 4.9-2
changelog:
  - Move development related docs to devel sub package
  - Cleanup spec and macros
  - Update valgrind ExclusiveArch


author: Nikola Forró <nforro@redhat.com> - 4.0.9-19
changelog:
  - Fix CVE-2020-35521 (#1945539)
  - Fix CVE-2020-35522 (#1945555)
  - Fix CVE-2020-35523 (#1945542)
  - Fix CVE-2020-35524 (#1945546)


author: Matej Mužila <mmuzila@redhat.com> - 4.0.9-23
changelog:
  - Fix various CVEs
  - Resolves: CVE-2022-0561 CVE-2022-0562 CVE-2022-22844 CVE-2022-0865
    CVE-2022-0891 CVE-2022-0924 CVE-2022-0909 CVE-2022-0908 CVE-2022-1355


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-2
changelog:
  - Revert "report error when virProcessGetStatInfo() is unable to parse data" (rhbz#2041610)
  - qemu: fix inactive snapshot revert (rhbz#2043584)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-3
changelog:
  - qemuDomainSetupDisk: Initialize 'targetPaths' (rhbz#2046172)
  - RHEL: Remove <glib-2.64.0 workaround for GSource race (rhbz#2045879)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-4
changelog:
  - qemu_command: Generate memory only after controllers (rhbz#2050697)
  - qemu: Validate domain definition even on migration (rhbz#2050702)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-5
changelog:
  - node_device: Rework udevKludgeStorageType() (rhbz#2056673)
  - node_device: Treat NVMe disks as regular disks (rhbz#2056673)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-6
changelog:
  - conf: Introduce memory allocation threads (rhbz#2067126)
  - qemu_capabilities: Detect memory-backend-*.prealloc-threads property (rhbz#2067126)
  - qemu_validate: Validate prealloc threads against qemuCpas (rhbz#2067126)
  - qemu_command: Generate prealloc-threads property (rhbz#2067126)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-7
changelog:
  - cpu_map: Disable cpu64-rhel* for host-model and baseline (rhbz#1851227)
  - cputest: Drop some old artificial baseline tests (rhbz#1851227)
  - cputest: Give better names to baseline tests (rhbz#1851227)
  - cputest: Add some real world baseline tests (rhbz#1851227)
  - cpu_x86: Consolidate signature match in x86DecodeUseCandidate (rhbz#1851227)
  - cpu_x86: Refactor feature list comparison in x86DecodeUseCandidate (rhbz#1851227)
  - cpu_x86: Penalize disabled features when computing CPU model (rhbz#1851227)
  - cpu_x86: Ignore enabled features for input models in x86DecodeUseCandidate (rhbz#1851227)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-8
changelog:
  - nwfilter: fix crash when counting number of network filters (CVE-2022-0897, rhbz#2063902)
  - virDomainDiskDefValidate: Improve error messages for 'startupPolicy' checks (rhbz#2095758)
  - domain_validate: Split out validation of disk startup policy (rhbz#2095758)
  - virDomainDiskDefValidateStartupPolicy: Validate disk type better (rhbz#2095758)
  - virDomainDiskTranslateSourcePool: Fix check of 'startupPolicy' definition (rhbz#2095758)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-9
changelog:
  - conf: virtiofs: add thread_pool element (rhbz#2079582)
  - qemu: virtiofs: format --thread-pool-size (rhbz#2079582)
  - conf: Move virDomainObj::originalMemlock into qemuDomainObjPrivate (rhbz#2089433)
  - qemu_domain: Format qemuDomainObjPrivate::originalMemlock (rhbz#2089433)
  - qemu: Add qemuDomainSetMaxMemLock helper (rhbz#2089433)
  - qemu_migration: Use qemuDomainSetMaxMemLock (rhbz#2089433)
  - qemu_migration: Restore original memory locking limit (rhbz#2089433)
  - Add VIR_MIGRATE_ZEROCOPY flag (rhbz#2089433)
  - virsh: Add support for VIR_MIGRATE_ZEROCOPY flag (rhbz#2089433)
  - qemu_migration: Implement VIR_MIGRATE_ZEROCOPY flag (rhbz#2089433)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-10
changelog:
  - security_selinux.c: Relabel existing mode="bind" UNIX sockets (rhbz#2101575)
  - RHEL: qemu_migration: Fix restoring memlock limit on destination (rhbz#2107954)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-10.1.el8
changelog:
  - qemu_process: Don't require a hugetlbfs mount for memfd (rhbz#2132176)
  - qemu_namespace: Tolerate missing ACLs when creating a path in namespace (rhbz#2132176)
  - qemu_namespace: Fix a corner case in qemuDomainGetPreservedMounts() (rhbz#2132176)
  - qemu_namespace: Introduce qemuDomainNamespaceSetupPath() (rhbz#2132176)
  - qemu_process.c: Propagate hugetlbfs mounts on reconnect (rhbz#2132176)
  - qemuProcessReconnect: Don't build memory paths (rhbz#2132176)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-10.2.el8
changelog:
  - util: json: Split out array->strinlist conversion from virJSONValueObjectGetStringArray (rhbz#2152079)
  - qemuAgentGetDisks: Don't use virJSONValueObjectGetStringArray for optional data (rhbz#2152079)
  - build: Only install libvirt-guests when building libvirtd (rhbz#2157091)
  - tools: Fix install_mode for some scripts (rhbz#2157091)


author: David King <dking@redhat.com> - 2.9.7-10
changelog:
  - Fix CVE-2021-3516 (#1956976)
  - Fix CVE-2021-3517 (#1957001)
  - Fix CVE-2021-3518 (#1957028)
  - Fix CVE-2021-3537 (#1957284)


author: Lubos Uhliarik <luhliari@redhat.com> - 1.11.3-1
changelog:
  - new version 1.11.3
  - Resolves: #1633401 - CVE-2018-11763 mod_http2: httpd:  DoS for HTTP/2
    connections by continuous SETTINGS


author: Lubos Uhliarik <luhliari@redhat.com> - 1.11.3-3
changelog:
  - Resolves: #1744999 - CVE-2019-9511 httpd:2.4/mod_http2: HTTP/2: large amount
    of data request leads to denial of service
  - Resolves: #1745086 - CVE-2019-9516 httpd:2.4/mod_http2: HTTP/2: 0-length
    headers leads to denial of service
  - Resolves: #1745154 - CVE-2019-9517 httpd:2.4/mod_http2: HTTP/2: request for
    large response leads to denial of service


author: Lubos Uhliarik <luhliari@redhat.com> - 1.15.7-1
changelog:
  - new version 1.15.7
  - Resolves: #1814236 - RFE: mod_http2 rebase 
  - Resolves: #1747289 - CVE-2019-10082 httpd:2.4/mod_http2: httpd: 
    read-after-free in h2 connection shutdown
  - Resolves: #1696099 - CVE-2019-0197 httpd:2.4/mod_http2: httpd: 
    mod_http2: possible crash on late upgrade
  - Resolves: #1696094 - CVE-2019-0196 httpd:2.4/mod_http2: httpd:
    mod_http2: read-after-free on a string compare
  - Resolves: #1677591 - CVE-2018-17189 httpd:2.4/mod_http2: httpd: 
    mod_http2: DoS via slow, unneeded request bodies


author: Lubos Uhliarik <luhliari@redhat.com> - 1.15.7-2
changelog:
  - Resolves: #1869073 - CVE-2020-9490 httpd:2.4/mod_http2: httpd: 
    Push diary crash on specifically crafted HTTP/2 header


author: Luboš Uhliarik <luhliari@redhat.com> - 1.15.7-4
changelog:
  - Resolves: #1966728 - CVE-2021-33193 httpd:2.4/mod_http2: httpd:
    Request splitting via HTTP/2 method injection and mod_proxy


author: Josef Ridky <jridky@redhat.com> - 1:5.8-19
changelog:
  - revert permission of config files to 600 (#1601060)
  - fix error message when the address specified by clientaddr option
    is wrong or cannot be bound (#1877375)
  - log error with /proc/net/if_inet6 only when IPv6 is enabled (#1824367)
  - fix issue with quoting empty passphrase (#1817225)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-21
changelog:
  - prevent parsing IP address twice (#1768908)
  - add support for digests detected from ECC certs (#1919714)
  - fix broken ErrorMsg at ucd-snmp (#1933150)
  - add support for intermediate certs (#1914656)
  - fix crash of certs with longer extension (#1908718)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1.3.3-2
changelog:
  - Do not remove SR-IOV that is not in desired state. RHBZ#2139698
  - Allow extra IP addresses found in verification stage. RHBZ#2128555


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.17.3-3
changelog:
  - Resolves: RHBZ#1945513, RHBZ#1945287
  - Resolves CVE-2021-23362 CVE-2021-27290
  - Bump for missing mentions of CVEs


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.17.5-1
changelog:
  - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939, CVE-2021-22940,
  - CVE-2021-23343, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
  - Resolves RHBZ#1847529 (make FIPS always available)
  - Resolves: RHBZ#1988600, RHBZ#1993815, RHBZ#1993809, RHBZ#1993096
  - Resolves: RHBZ#1986743, RHBZ#1993947, RHBZ#1993940, RHBZ#1989427
  - Resolves: RHBZ#1951620 (make FIPS always available)


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.18.2-1
changelog:
  - Resolves: RHBZ#2026325
  - Resolves: RHBZ#2014130, RHBZ#2014124, RHBZ#2013826, RHBZ#2024921
  - Rebase to new version to fix CVEs


author: Jan Staněk <jstanek@redhat.com> - 1:14.18.2-2
changelog:
  - Replace with_* macros with RPM confitionals
  - Unify configure calls into single command
  - Refactor bootstrap-related parts
  - Decouple dependency bundling from bootstrapping


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.20.0-1
changelog:
  - Rebase to latest release
  - Resolves: #2106281, #2108056, #2108061, #2108066, #2108071, #2108139
  - Remove libs patch
  - Build without corepack


author: Jan Staněk <jstanek@redhat.com> - 1:14.20.1-2
changelog:
  - Record issues fixed in the current version
    Resolves: CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824


author: Jan Staněk <jstanek@redhat.com> - 1:14.21.1-2
changelog:
  - Apply upstream fix for CVE-2022-24999
    Resolves: CVE-2022-24999
  - Record CVEs fixed by current or previous upstream releases
    Resolves: CVE-2021-44906


author: Jan Staněk <jstanek@redhat.com> - 1:14.21.3-1
changelog:
  - Rebase to 14.21.3
    Resolves: rhbz#2153712
    Resolves: CVE-2022-25881 CVE-2023-23918 CVE-2023-23920 CVE-2022-38900
    Resolves: CVE-2022-4904


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.13.1-1
changelog:
  - Resolves: RHBZ#2014132, RHBZ#2014126, RHBZ#2013828, RHBZ#2024920
  - Resolves: RHBZ#2026329
  - Rebase to LTS release and to fix multiple low and medium CVEs


author: Jan Staněk <jstanek@redhat.com> - 1:16.14.0-5
changelog:
  - Unify configure calls into single command
  - Refactor bootstrap-related parts
  - Decouple dependency bundling from bootstrapping


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.16.0-1
changelog:
  - Resolves: #2104754, #2108057, #2108062, #2108067, #2108072
  - Resolves CVE-2022-29244, CVE-2022-32212/3/4/5
  - Resolves: #2106285
  - Rebase to latest release


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.17.1-1
changelog:
  - Rebase to version 16.17.1
  - Resolves: CVE-2022-35255 CVE-2022-35256
  - Resolves: #2130553
  - Resolves #2132003
  - Resolves #2121095


author: Jan Staněk <jstanek@redhat.com> - 1:16.18.1-2
changelog:
  - Record CVE references already addressed in this or previous upstream versions
    Resolves: CVE-2021-44531 CVE-2021-44532 CVE-2021-44533 CVE-2022-21824


author: Jan Staněk <jstanek@redhat.com> - 1:16.19.1-1
changelog:
  - Rebase to 16.19.1
    Resolves: rhbz#2153713
    Resolves: CVE-2023-23918 CVE-2023-23919 CVE-2023-23936 CVE-2023-24807 CVE-2023-23920
    Resolves: CVE-2022-25881 CVE-2022-4904


author: Jan Staněk <jstanek@redhat.com> - 1:18.6.0-1
changelog:
  - Rebase to version 18.6.0
    Resolves: CVE-2022-32212 CVE-2022-32213 CVE-2022-32214 CVE-2022-32215
    Resolves: CVE-2022-29244


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:18.14.2-1
changelog:
  - Rebase to 18.14.2
  - Resolves: #2178087
  - Resolves: CVE-2022-25881, CVE-2022-4904, CVE-2023-23936, CVE-2023-24807
  - Resolves: CVE-2023-23918, CVE-2023-23919, CVE-2023-23920


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 2.0.15-1
changelog:
  - Resolves: RHBZ#2005419
  - Resolves CVE-2020-28469
  - Rebase to newest version
  - Change source to npmjs.com


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 2.0.19-2
changelog:
  - Switched from autosetup
  - Removed CODE_OF_CONDUCT.md and faq.md which is not present in npmjs package, might switch to GH sources in the future
  - Resolves: RHBZ#2108141


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 2.0.15-1
changelog:
  - Resolves: RHBZ#1991322, RHBZ#1948030
  - Resolves CVE-2020-28469
  - Rebase to newest version
  - Change source to npmjs.com


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 2.0.19-2
changelog:
  - Switched from autosetup
  - Removed CODE_OF_CONDUCT.md and faq.md which is not present in npmjs package, might switch to GH sources in the future
  - Resolves: RHBZ#2108140


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-5
changelog:
  - FIPS 140-3 changes
  -  Reject Small RSA keys, 1024 bit keys are marked as FIP OK when verifying, reject
     signature keys by policy
  -  Allow applications to retrigger selftests on demand.


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-8
changelog:
  - Update fips default for pk12util to AES rather than TDES
  - Fix bug in pkcs12 files with null passwords


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-10
changelog:
  - Fix QA found failures:
  -  remove extra '+' from sslpolicy.txt file causing test error values
  -  only use GRND_RANDOM if the kernel is in FIPS mode.


author: Jindrich Novy <jnovy@redhat.com> - 1.2.1-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.1
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.2.1-1
changelog:
  - update to
    https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.1
  - require crun >= 0.17
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.2.3-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.3
  - fix build
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1.2.5-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.5
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1.2.6-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.6
  - Related: #2061390


author: Than Ngo <than@redhat.com> - 3.18.0-1
changelog:
  - Resolves: #2043845, rebase to 3.18.0
  - Resolves: #2043854, add crypto counters
  - Resolves: #2043855, support crypto profiles


author: Than Ngo <than@redhat.com> - 3.18.0-3
changelog:
  - Related: #2043854, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
  - Resolves: #2112785, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL


author: Than Ngo <than@redhat.com> - 3.18.0-4
changelog:
  - Resolves: #2129059, C_GenerateKeyPair() fails after generating > 500 RSA keys with CEX7 crypto cards


author: Jan Černý <jcerny@redhat.com> - 1.3.5-8
changelog:
  - Allow local DS components (rhbz#1970529)
  - Fix hostname detection in offline scan of UBI 9 images (rhbz#1893888)
  - Add an alternative source of hostname (rhbz#1977668)
  - Fix oscap-chroot errors in process58_probe caused by empty /proc (rhbz#2008922)


author: Jan Černý <jcerny@redhat.com> - 1.3.5-9
changelog:
  - Lower memory limits and improve their checking (rhbz#2021851)
  - Remove timestamp from the user manual (rhbz#2022364)


author: Jan Černý <jcerny@redhat.com> - 1.3.6-1
changelog:
  - Upgrade to the latest upstream release (rhbz#2041781)
  - Select and exclude groups of rules on the command line
  - The boot-time remediation service for systemd's Offline Update mode


author: Jan Černý <jcerny@redhat.com> - 1.3.6-4
changelog:
  - Fix potential invalid scan results in OpenSCAP (rhbz#2111040)
  - Remove oscap-remediate service (rhbz#2111360)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-9
changelog:
  - CVE-2020-14145 openssh: Observable Discrepancy leading to an information
    leak in the algorithm negotiation (#1882252)
  - Hostbased ssh authentication fails if session ID contains a '/' (#1944125)


author: Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-14
changelog:
  - Upstream: add a local implementation of BSD realpath() for sftp-server (#2064249)
  - Change product name from Fedora to RHEL in openssh-7.8p1-UsePAM-warning.patch (#1953807)
  - Include caveat for crypto-policy in sshd manpage (#2044354)
  - Change log level of FIPS specific log message to verbose (#2050511)
  - Clarify force_file_perms (-m) documentation in sftp-server manpage (#1862504)
  - Minimize the use of SHA1 as a proof of possession for RSA key (#2093897)


author: Daiki Ueno <dueno@redhat.com> 1.1.1g-16
changelog:
  - Use AI_ADDRCONFIG only when explicit host name is given
  - Allow only curves defined in RFC 8446 in TLS 1.3


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067146


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2092462
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090372
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098279


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.3-1
changelog:
  - crm_resource --restart fails to restart clone instances except instance 0
  - Add new multiple-active option for "stop unexpected instances"
  - Unable to show metadata for "service" agents with "@" and "." in the name
  - Resource ocf:pacemaker:attribute does not comply with the OCF 1.1 standard
  - Allow resource meta-attribute to exempt resource from node health restrictions
  - Show node health states in crm_mon
  - Rebase pacemaker on upstream 2.1.3-rc2 release
  - crm_mon API result does not validate against schema if fence event has exit-reason
  - Resolves: rhbz1930578
  - Resolves: rhbz2036815
  - Resolves: rhbz2045096
  - Resolves: rhbz2049722
  - Resolves: rhbz2059638
  - Resolves: rhbz2065812
  - Resolves: rhbz2072107
  - Resolves: rhbz2086230


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.3-2
changelog:
  - crm_attribute works on remote node command line when hostname differs
  - Rebase pacemaker on upstream 2.1.3 final release
  - Resolves: rhbz1384172
  - Resolves: rhbz2072107


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.4-1
changelog:
  - Fencer should not ignore CIB updates when stonith is disabled
  - Rebase pacemaker on upstream 2.1.4 final release
  - Fix typo in ocf:pacemaker:HealthSMART meta-data
  - Resolves: rhbz2055935
  - Resolves: rhbz2072107
  - Resolves: rhbz2094855


author: Ken Gaillot <kgaillot@redhat.com> - 2.1.4-4
changelog:
  - Ensure all nodes are re-unfenced after device configuration change
  - crm_resource --why now checks node health status
  - Resolves: rhbz1872483
  - Resolves: rhbz2065818


author: Chris Lumens <clumens@redhat.com> - 2.1.4-5.1
changelog:
  - Fix regression where reordered resources do not get moved
  - Execute resource metadata actions asynchronously
  - Resolves: rhbz2125588
  - Resolves: rhbz2125589


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.13-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Updated pcs-web-ui
  - Updated bundled rubygems: backports, daemons, ethon ffi, json, ruby2_keywords, thin
  - Resolves: rhbz#1730232 rhbz#1786964 rhbz#1791661 rhbz#1791670 rhbz#1874624 rhbz#1909904 rhbz#1950551 rhbz#1954099 rhbz#2019894 rhbz#2023845 rhbz#2059500 rhbz#2064805 rhbz#2068456


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.14-1
changelog:
  - Rebased to latest upstream sources (see CHANGELOG.md)
  - Updated bundled rubygems: rack
  - Resolves: rhbz#2059500 rhbz#2096787 rhbz#2097383 rhbz#2097391 rhbz#2097392 rhbz#2097393


author: Miroslav Lisik <mlisik@redhat.com> - 0.10.14-2
changelog:
  - Fixed booth ticket mode value case insensitive
  - Fixed booth sync check whether /etc/booth exists
  - Resolves: rhbz#1786964 rhbz#1791670


author: Michal Pospisil <mpospisi@redhat.com> - 0.10.14-5.el8_7.1
changelog:
  - Fixed displaying of bool and integer values in `pcs resource config` command
  - Resolves: rhbz#2151577


author: Michal Pospisil <mpospisi@redhat.com> - 0.10.14-5.el8_7.2
changelog:
  - Updated bundled rubygems: mustermann, rack, rack_protection, sinatra, tilt
  - Added license for rubygem ruby2_keywords
  - Resolves: rhbz#2159424


author: Peter Jones <pjones@redhat.com> - 0.112-25
changelog:
  - Preserve .py timestamp during install so .pyc/.pyo files have the same
    timestamp on all arches, preventing rpmdiff from complaining.
    Related: rhbz#1625388


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-6
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/4f91b37)
  - Related: #2009106


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-8
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/c5d8129)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-9
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/801b7e8)
  - Resolves: #2074144


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-10
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/47b310e)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-11
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/4cd74c2)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-12
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/1c4d1a7)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-13
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/37cd5bf)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-14
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/ab15cf1)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-15
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/b084df1)
  - Related: #2165695


author: Jindrich Novy <jnovy@redhat.com> - 2:4.0.2-1
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.0-rhel
    (https://github.com/containers/podman/commit/94aa329)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:4.0.2-2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.0-rhel
    (https://github.com/containers/podman/commit/ce91610)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:4.0.2-3
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.0-rhel
    (https://github.com/containers/podman/commit/6cb5039)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:4.0.2-5
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.0-rhel
    (https://github.com/containers/podman/commit/2e12f02)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:4.0.2-6
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.0-rhel
    (https://github.com/containers/podman/commit/bfc8b36)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:4.0.2-7
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.0-rhel
    (https://github.com/containers/podman/commit/3efe4c2)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:4.0.2-8
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.0-rhel
    (https://github.com/containers/podman/commit/33084eb)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:4.0.2-9
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.0-rhel
    (https://github.com/containers/podman/commit/0b00627)
  - Resolves: #2154015


author: Jindrich Novy <jnovy@redhat.com> - 2:4.2.0-1
changelog:
  - update to https://github.com/containers/podman/releases/tag/v4.2.0
    (https://github.com/containers/podman/commit/7fe5a419cfd2880df2028ad3d7fd9378a88a04f4)
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 2:4.2.0-1
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/7154106)
  - Related: #2130911


author: Jindrich Novy <jnovy@redhat.com> - 3:4.2.0-2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/4978898)
  - Resolves: #2125241


author: Jindrich Novy <jnovy@redhat.com> - 3:4.2.0-3
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/d520a5c)
  - Resolves: #2136433


author: Jindrich Novy <jnovy@redhat.com> - 3:4.2.0-4
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/35c0df3)
  - Resolves: #2125645


author: Jindrich Novy <jnovy@redhat.com> - 3:4.2.0-5
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/6742838)
  - Resolves: #2144754


author: Jindrich Novy <jnovy@redhat.com> - 3:4.2.0-6
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/bfac4a5)
  - Resolves: #2152027


author: Jindrich Novy <jnovy@redhat.com> - 3:4.2.0-7
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/0608f55)
  - Resolves: #2158635


author: Jindrich Novy <jnovy@redhat.com> - 3:4.2.0-8
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/28df097)
  - Resolves: #2158635


author: Patrik Novotný <panovotn@redhat.com> - 10.15-1
changelog:
  - Rebase to upstream release 10.15
    Resolves: rhbz#1898214
    Resolves: rhbz#1898342
    Resolves: rhbz#1898248


author: Filip Januš <fjanus@redhat.com> - 10.19-2
changelog:
  - Add missing files into file section of server package
    postgresql-setup v8.6 newly provides postgresql-upgrade


author: Filip Januš <fjanus@redhat.com> - 10.21-1
changelog:
  - Resolves: CVE-2022-1552
  - Update to 10.21
  - Release notes: https://www.postgresql.org/docs/release/10.21/


author: Filip Januš <fjanus@redhat.com> - 13.7-1
changelog:
  - Resolves: CVE-2022-1552
  - Update to 13.7
  - Release notes: https://www.postgresql.org/docs/release/13.7/


author: Severin Gehwolf <sgehwolf@redhat.com> - 0.12.0-7
changelog:
  - Add JDK binding sub-packages so that the package
    can be used with either JDK 11 or JDK 17.
  - Add requirement on base package for the JDK binding packages.


author: Jindrich Novy <jnovy@redhat.com> - 4.2.0-2
changelog:
  - fix "[RFE] python-podman: Podman support to perform custom actions on unhealthy containers"
  - Resolves: #2132360


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-4
changelog:
  - New subpackage platform-python-setuptools without files from /usr/bin/*
  - python3-setuptools contains only files from /usr/bin/* and depends
    on platform-python-setuptools
  - Resolves: rhbz#1641973


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-41
changelog:
  - Security fix for CVE-2021-3733: Denial of service when identifying crafted invalid RFCs
  Resolves: rhbz#1995234


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-43
changelog:
  - Change shouldRollover() methods of logging.handlers to only rollover regular files
  Resolves: rhbz#2009200


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-44
changelog:
  - Use the monotonic clock for theading.Condition
  - Use the monotonic clock for the global interpreter lock
  Resolves: rhbz#2003758


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-45
changelog:
  - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response
  Resolves: rhbz#2036020


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-46
changelog:
  - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2047376, rhbz#2060435


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-48.1
changelog:
  - Security fixes for CVE-2020-10735, CVE-2021-28861 and CVE-2022-45061
  Resolves: rhbz#1834423, rhbz#2120642, rhbz#2144072


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.6-1
changelog:
  - Update to 3.9.6
  - Fix CVE-2021-29921: Improper input validation of octal strings in the ipaddress module
  Resolves: rhbz#1957458


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.13-1
changelog:
  - Update to 3.9.13
  - Security fix for CVE-2015-20107
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2075390


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-14
changelog:
  - kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch [bz#2065043]
  - kvm-target-i386-properly-reset-TSC-on-reset.patch [bz#2070417]
  - kvm-ui-cursor-fix-integer-overflow-in-cursor_alloc-CVE-2.patch [bz#2040734]
  - Resolves: bz#2065043
    (Remove upstream-only devices from the qemu-kvm binary)
  - Resolves: bz#2070417
    (Windows guest hangs after updating and restarting from the guest OS [rhel-8.7.0])
  - Resolves: bz#2040734
    (CVE-2021-4206 virt:rhel/qemu-kvm: QEMU: QXL: integer overflow in cursor_alloc() can lead to heap buffer overflow [rhel-8.7])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-15
changelog:
  - kvm-virtio-gpu-do-not-byteswap-padding.patch [bz#1916415]
  - kvm-linux-headers-update-to-5.16-rc1.patch [bz#1916415]
  - kvm-linux-headers-Update-headers-to-v5.17-rc1.patch [bz#1916415]
  - kvm-linux-headers-include-missing-changes-from-5.17.patch [bz#1916415]
  - kvm-x86-Fix-the-64-byte-boundary-enumeration-for-extende.patch [bz#1916415]
  - kvm-x86-Add-AMX-XTILECFG-and-XTILEDATA-components.patch [bz#1916415]
  - kvm-x86-Grant-AMX-permission-for-guest.patch [bz#1916415]
  - kvm-x86-Add-XFD-faulting-bit-for-state-components.patch [bz#1916415]
  - kvm-x86-Add-AMX-CPUIDs-enumeration.patch [bz#1916415]
  - kvm-x86-add-support-for-KVM_CAP_XSAVE2-and-AMX-state-mig.patch [bz#1916415]
  - kvm-x86-Support-XFD-and-AMX-xsave-data-migration.patch [bz#1916415]
  - kvm-target-i386-kvm-do-not-access-uninitialized-variable.patch [bz#1916415]
  - kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch [bz#1916415]
  - kvm-virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch [bz#2069946]
  - kvm-virtio-net-align-ctrl_vq-index-for-non-mq-guest-for-.patch [bz#2069946]
  - kvm-vhost-vdpa-fix-improper-cleanup-in-net_init_vhost_vd.patch [bz#2069946]
  - kvm-vhost-net-fix-improper-cleanup-in-vhost_net_start.patch [bz#2069946]
  - kvm-vhost-vdpa-backend-feature-should-set-only-once.patch [bz#2069946]
  - kvm-vhost-vdpa-change-name-and-polarity-for-vhost_vdpa_o.patch [bz#2069946]
  - kvm-virtio-net-don-t-handle-mq-request-in-userspace-hand.patch [bz#2069946]
  - kvm-ide-Increment-BB-in-flight-counter-for-TRIM-BH.patch [bz#2029980]
  - kvm-block-Make-bdrv_refresh_limits-non-recursive.patch [bz#2072932]
  - kvm-iotests-Allow-using-QMP-with-the-QSD.patch [bz#2072932]
  - kvm-iotests-graph-changes-while-io-New-test.patch [bz#2072932]
  - Resolves: bz#1916415
    ([Intel 8.7 FEAT] qemu-kvm Sapphire Rapids (SPR) AMX Instructions)
  - Resolves: bz#2069946
    (PXE boot crash qemu when using multiqueue vDPA)
  - Resolves: bz#2029980
    (Failed assertion in IDE emulation with Ceph backend)
  - Resolves: bz#2072932
    (Qemu coredump when refreshing block limits on an actively used iothread block device [rhel.8.7])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-16
changelog:
  - kvm-virtiofsd-Fix-breakage-due-to-fuse_init_in-size-chan.patch [bz#2097209]
  - kvm-hw-block-fdc-Prevent-end-of-track-overrun-CVE-2021-3.patch [bz#1951521]
  - kvm-tests-qtest-fdc-test-Add-a-regression-test-for-CVE-2.patch [bz#1951521]
  - Resolves: bz#2097209
    ([virtiofs] mount virtiofs failed: SELinux: (dev virtiofs, type virtiofs) getxattr errno 111)
  - Resolves: bz#1951521
    (CVE-2021-3507 virt:rhel/qemu-kvm: QEMU: fdc: heap buffer overflow in DMA read data transfers [rhel-8])


author: Camilla Conte <cconte@redhat.com> - 6.2.0-17
changelog:
  - kvm-migration-Never-call-twice-qemu_target_page_size.patch [bz#2072049]
  - kvm-multifd-Rename-used-field-to-num.patch [bz#2072049]
  - kvm-multifd-Add-missing-documentation.patch [bz#2072049]
  - kvm-multifd-The-variable-is-only-used-inside-the-loop.patch [bz#2072049]
  - kvm-multifd-remove-used-parameter-from-send_prepare-meth.patch [bz#2072049]
  - kvm-multifd-remove-used-parameter-from-send_recv_pages-m.patch [bz#2072049]
  - kvm-multifd-Fill-offset-and-block-for-reception.patch [bz#2072049]
  - kvm-multifd-Make-zstd-compression-method-not-use-iovs.patch [bz#2072049]
  - kvm-multifd-Make-zlib-compression-method-not-use-iovs.patch [bz#2072049]
  - kvm-migration-All-this-fields-are-unsigned.patch [bz#2072049]
  - kvm-multifd-Move-iov-from-pages-to-params.patch [bz#2072049]
  - kvm-multifd-Make-zlib-use-iov-s.patch [bz#2072049]
  - kvm-multifd-Make-zstd-use-iov-s.patch [bz#2072049]
  - kvm-multifd-Remove-send_write-method.patch [bz#2072049]
  - kvm-multifd-Use-a-single-writev-on-the-send-side.patch [bz#2072049]
  - kvm-multifd-Use-normal-pages-array-on-the-send-side.patch [bz#2072049]
  - kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch [bz#2072049]
  - kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch [bz#2072049]
  - kvm-migration-Add-zero-copy-send-parameter-for-QMP-HMP-f.patch [bz#2072049]
  - kvm-migration-Add-migrate_use_tls-helper.patch [bz#2072049]
  - kvm-multifd-multifd_send_sync_main-now-returns-negative-.patch [bz#2072049]
  - kvm-multifd-Send-header-packet-without-flags-if-zero-cop.patch [bz#2072049]
  - kvm-multifd-Implement-zero-copy-write-in-multifd-migrati.patch [bz#2072049]
  - kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch [bz#2072049]
  - kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch [bz#2072049]
  - kvm-migration-Change-zero_copy_send-from-migration-param.patch [bz#2072049]
  - kvm-migration-Add-migration_incoming_transport_cleanup.patch [bz#2097652]
  - kvm-migration-Allow-migrate-recover-to-run-multiple-time.patch [bz#2097652]
  - kvm-pc-bios-s390-ccw-virtio-Introduce-a-macro-for-the-DA.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-bootmap-Improve-the-guessing-logic-.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-blkdev-Simplify-fix-virtio_i.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-blkdev-Remove-virtio_assume_.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-Set-missing-status-bits-whil.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-Read-device-config-after-fea.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-Beautify-the-code-for-readin.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-Split-virtio-scsi-code-from-virtio_.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-blkdev-Request-the-right-fea.patch [bz#2098076]
  - Resolves: bz#2072049
    (Pull  MSG_ZEROCOPY on QEMU Live Migration Patches into RHEL 8)
  - Resolves: bz#2097652
    (The migration port is not released if use it again for recovering postcopy migration)
  - Resolves: bz#2098076
    (virtio-blk: Can't boot fresh installation from used virtio-blk dasd disk under certain conditions)


author: Camilla Conte <cconte@redhat.com> - 6.2.0-18
changelog:
  - kvm-linux-aio-fix-unbalanced-plugged-counter-in-laio_io_.patch [bz#2105410]
  - kvm-linux-aio-explain-why-max-batch-is-checked-in-laio_i.patch [bz#2105410]
  - Resolves: bz#2105410
    (Stalled IO Operations in VM)


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.2.0-19
changelog:
  - kvm-migration-Introduce-ram_transferred_add.patch [bz#2110203]
  - kvm-migration-Tally-pre-copy-downtime-and-post-copy-byte.patch [bz#2110203]
  - kvm-QIOChannelSocket-Fix-zero-copy-flush-returning-code-.patch [bz#2110203]
  - kvm-Add-dirty-sync-missed-zero-copy-migration-stat.patch [bz#2110203]
  - kvm-migration-multifd-Report-to-user-when-zerocopy-not-w.patch [bz#2110203]
  - kvm-migration-Avoid-false-positive-on-non-supported-scen.patch [bz#2110203]
  - kvm-migration-add-remaining-params-has_-true-in-migratio.patch [bz#2110203]
  - kvm-QIOChannelSocket-Add-support-for-MSG_ZEROCOPY-IPV6.patch [bz#2110203]
  - kvm-pc-bios-s390-ccw-Fix-booting-with-logical-block-size.patch [bz#2112296]
  - Resolves: bz#2110203
    (zerocopy capability can be enabled when set migrate capabilities with multifd and compress/xbzrle together)
  - Resolves: bz#2112296
    (virtio-blk: Can't boot fresh installation from used 512 cluster_size image under certain conditions)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-20
changelog:
  - kvm-scsi-generic-Fix-emulated-block-limits-VPD-page.patch [bz#2120279]
  - Resolves: bz#2120279
    (Wrong max_sectors_kb and Maximum transfer length on the pass-through device [rhel-8.7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.2.0-20.el8.1
changelog:
  - kvm-i386-reset-KVM-nested-state-upon-CPU-reset.patch [bz#2116743]
  - kvm-i386-do-kvm_put_msr_feature_control-first-thing-when.patch [bz#2116743]
  - Resolves: bz#2116743
    ([RHEL8.7] Guests in VMX root operation fail to reboot with QEMU's 'system_reset' command)


author: Miroslav Rezanina <mrezanin@redhat.com> - 6.2.0-20.el8_7.2
changelog:
  - kvm-virtiofsd-use-g_date_time_get_microsecond-to-get-sub.patch [bz#2132391]
  - Resolves: bz#2132391
    ([virtiofs] virtiofsd debug log's timestamp is NULL [rhel-8.7.0.z])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-21.el8_7.2
changelog:
  - kvm-ui-vnc.c-Fixed-a-deadlock-bug.patch [bz#2148504]
  - kvm-hw-display-qxl-Have-qxl_log_command-Return-early-if-.patch [bz#2152085]
  - kvm-hw-display-qxl-Document-qxl_phys2virt.patch [bz#2152085]
  - kvm-hw-display-qxl-Pass-requested-buffer-size-to-qxl_phy.patch [bz#2152085]
  - kvm-hw-display-qxl-Avoid-buffer-overrun-in-qxl_phys2virt.patch [bz#2152085]
  - kvm-hw-display-qxl-Assert-memory-slot-fits-in-preallocat.patch [bz#2152085]
  - Resolves: bz#2148504
    (VMs hung on vnc_clipboard_send [rhel-8.7.0.z])
  - Resolves: bz#2152085
    (CVE-2022-4144 virt:rhel/qemu-kvm: QEMU: QXL: qxl_phys2virt unsafe address translation can lead to out-of-bounds read [rhel-8] [rhel-8.7.0.z])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-22.el8_7.2
changelog:
  - kvm-migration-Read-state-once.patch [bz#2168217]
  - Resolves: bz#2168217
    (while live-migrating many instances concurrently, libvirt sometimes return internal error: migration was active, but no RAM info was set [rhel-8.7.0.z])


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-19
changelog:
  - Filesystem: fix UUID/label device support when there's whitespace
    between parameter and UUID/label

    Resolves: rhbz#2049414


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-22
changelog:
  - gcp-vpc-move-route/gcp-vpc-move-vip: upgrade bundled
    python-httplib2 to fix SSL issue

    Resolves: rhbz#2097462


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-26
changelog:
  - openstack-cinder-volume/openstack-floating-ip/openstack-info/
    openstack-virtual-ip: new resource agents

    Resolves: rhbz#1908146, rhbz#1908147, rhbz#1908148, rhbz#1949114


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-29
changelog:
  - ethmonitor/pgsql: remove attrd_updater "-q" parameter to solve issue
    with Pacemaker 2.1.3+ not ignoring it

    Resolves: rhbz#2116941


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-29.3
changelog:
  - vdo-vol: dont fail probe action when the underlying device doesnt
    exist

    Resolves: rhbz#2144866


author: Colin Walters <walters@verbum.org> - 2020.7-4
changelog:
  - Backport https://github.com/coreos/rpm-ostree/pull/2386/commits/aa8e49aaeddfc5d38651fa08f46e059655818fd1
    Resolves: #1944760


author: Luca BRUNO <lucab@lucabruno.net> - 2021.5-1
changelog:
  - New upstream version
    https://github.com/coreos/rpm-ostree/releases/tag/v2021.5
    Resolves: rhbz#1959874


author: Luca BRUNO <lucab@redhat.com> - 2021.5-2
changelog:
  - Backport _dbpath fixes, see
    https://github.com/coreos/rpm-ostree/issues/2904
    Resolves: rhbz#1973579


author: Colin Walters <walters@verbum.org> - 2022.2.8.gd50a74bd-2
changelog:
  - Update to latest rhel8 branch
    https://github.com/coreos/rpm-ostree/pull/3749
    https://github.com/coreos/rpm-ostree/pull/3751
    Resolves: rhbz#2095528


author: Colin Walters <walters@verbum.org> - 2022.10.86.gd8f0c67a-3
changelog:
  - Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
    https://github.com/coreos/rpm-ostree/commit/d8f0c67a0eba32281c9f2782a286e06486a4b909
    Resolves: rhbz#2105414


author: Colin Walters <walters@verbum.org> - 2022.10.90.g4abaf4b4-4
changelog:
  - Update to latest https://github.com/coreos/rpm-ostree/tree/rhel8 at commit
    https://github.com/coreos/rpm-ostree/commit/4abaf4b4
    Resolves: rhbz#2118774


author: Colin Walters <walters@verbum.org> - 2022.10.90.g4abaf4b4-5
changelog:
  - Backport
    https://github.com/coreos/rpm-ostree/commit/0049dbdd91cc0c1900132374645c5114063db04d
    Resolves: rhbz#2137905


author: Joseph Marrero <jmarrero@redhat.com> - 2022.10.90.g4abaf4b4-6
changelog:
  - Backport
    https://github.com/coreos/rpm-ostree/commit/9dc5dcd0594d122172493695e31b0c63e7ea2e74
    Resolves: rhbz#2167476


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-68.rc92
changelog:
  - update to https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
  - propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-73.rc95
changelog:
  - fix podman run --pid=host command causes OCI permission error
  - rc95 fixes CVE-2021-30465
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.0.3-6
changelog:
  - Fix every podman run invocation generates two "Couldn't stat device
    /dev/char/10:200: No such file or directory" lines in the journal
  - Related: #2061390


author: Jindrich Novy <jnovy@redhat.com> - 1:1.1.3-3
changelog:
  - fix "Error: runc: exec failed: unable to start container process:
    open /dev/pts/0: operation not permitted: OCI permission denied"
  - Related: #2061390


author: Pavel Filipenský <pfilipen@redhat.com> - 4.16.3-0
changelog:
  - related: rhbz#2077468 - Rebase Samba to 4.16.3
  - resolves: rhbz#2106672 - The pcap background queue process should not be stopped
  - resolves: rhbz#2106263 - Fix crash in rpcd_classic
  - resolves: rhbz#2100093 - Fix net ads info returns LDAP server and LDAP server name


author: Pavel Filipenský <pfilipen@redhat.com> - 4.16.4-5
changelog:
  - resolves: rhbz#2170394 - Fix share enum
  - resolves: rhbz#2170467 - Add to package ctdb dependency for package samba-winbind-clients
  - resolves: rhbz#2170468 - Add package dcerpc - fix winbind to retrieve user groups from AD
  - resolves: rhbz#2170469 - Create package samba-tools


author: Watson Sato <wsato@redhat.com> - 0.1.60-8
changelog:
  - Update to ensure a sysctl option is not defined in multiple files (RHBZ#2079241)
  - Update RHEL8 STIG profile to V1R6 (RHBZ#2079241)


author: Watson Sato <wsato@redhat.com> - 0.1.60-9
changelog:
  - Fix validation of OVAL 5.10 content (RHBZ#2079241)
  - Fix Ansible sysctl remediation (RHBZ#2079241)


author: Vojtech Polasek <vpolasek@redhat.com> - 0.1.63-2
changelog:
  - aligning with the latest STIG update (RHBZ#2112937)
  - OSPP: use Authselect minimal profile (RHBZ#2117192)
  - OSPP: change rules for protecting of boot (RHBZ#2116440)
  - add warning about configuring of TCP queues to rsyslog_remote_loghost (RHBZ#2078974)
  - fix handling of Defaults clause in sudoers (RHBZ#2083109)
  - make rules checking for mount options of /tmp and /var/tmp applicable only when the partition really exists (RHBZ#2032403)
  - fix handling of Rsyslog include directives (RHBZ#2075384)


author: Watson Sato <wsato@redhat.com> - 0.1.66-1
changelog:
  - Rebase to a new upstream release 0.1.66 (RHBZ#2168079)
  - Update RHEL8 STIG profile to V1R9 (RHBZ#2168075)
  - Fix levels of CIS rules (RHBZ#2168072)
  - Remove unused RHEL8 STIG control file (RHBZ#2168069)
  - Fix handling of space in sudo_require_reauthentication (RHBZ#2168066)
  - Add rule for audit immutable login uids (RHBZ#2168063)
  - Fix remediation of audit watch rules (RHBZ#2168060)
  - Align file_permissions_sshd_private_key with DISA Benchmark (RHBZ#2168057)
  - Fix applicability of kerberos rules (RHBZ#2168054)
  - Add support rainer scripts in rsyslog rules (RHBZ#2168050)


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-9
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/a05ddb8)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-10
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/6c0e35a)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-11
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/b4210c0)
  - Resolves: #1914884


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-12
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/3abb778)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/e72dd9c)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-10
changelog:
  - update shortnames from Pyxis
  - sync with the vendored versions in 3.0-8.5.0
  - bump release to assure upgrade path from 3.0-8.4.0
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.4-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/9921983)
  - Related: #2001445


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.4-2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/7300333)
  - Related: #2061390


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.5-1
changelog:
  - Upstream release 0.56.5
  - Resolves: rhbz#1751295: (2) When sync-repl is enabled, slapi-nis can deadlock during retrochanglog trimming
  - Resolves: rhbz#1768156: ERR - schemacompat - map rdlock: old way MAP_MONITOR_DISABLED


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.6-2
changelog:
  - CVE 2021-3480:  idm:DL1/slapi-nis: NULL dereference (DoS) with specially crafted Binding DN
  - Resolves: rhbz#1944713


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.56.6-3
changelog:
  - Resolves: rhbz#1958909 - fix regression for scoped searches in compat tree
  - Resolves: rhbz#1978189 - better handle error response from libsss_nss_idmap


author: Alexander Bokovoy <abokovoy@redhat.com> - 0.60.0-1
changelog:
  - upstream release 0.60.0
  - Change license from GPLv2 to GPLv3+ to follow 389-ds licensing
  - Resolves: rhbz#1984010
    Fix ID views integration
  - Fix base scope lookups
  - Resolves: rhbz#1784172
    Bump NIS max dgram size to 8KB by default instead of 1KB
  - Resolves: rhbz#2070575
    Allow to rebuild the compat tree


author: Jindrich Novy <jnovy@redhat.com> - 1.1.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.1
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.2
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.3
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.4-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.4
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.6-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.6
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.7-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.7
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.8-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.8
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.2.0-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.2.0
  - Related: #2061390


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-10
changelog:
  - Fixed CVE-2020-13632 (#1845572)
  - Fixed CVE-2020-13631 (#1845474)
  - Fixed CVE-2020-13630 (#1845153)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-14
changelog:
  - Fixed CVE-2019-5827 (#1710184)
  - Fixed CVE-2019-13750 (#1786510)
  - Fixed CVE-2019-13751 (#1786522)
  - Fixed CVE-2019-19603 (#1792013)
  - Fixed CVE-2020-13435 (#1841233)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.0-2
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
  - Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
  - Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
  - Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
  - Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
  - Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
  - Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
  - Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
  - Resolves: rhbz#2087745 - 2FA prompting setting ineffective
  - Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4.1
changelog:
  - Resolves: rhbz#2128544 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict) [rhel-8.7.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4.2
changelog:
  - Resolves: rhbz#2139871 - Analyzer: Optimize and remove duplicate messages in verbose list [rhel-8.7.0.z]
  - Resolves: rhbz#2142961 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged [rhel-8.7.0.z]
  - Resolves: rhbz#2148989 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around [rhel-8.7.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4.3
changelog:
  - Resolves: rhbz#2152883 - authenticating against external IdP services okta (native app) with OAuth client secret failed [rhel-8.7.0.z]


author: Clark Williams <williams@redhat.com> - 1.10-1
changelog:
  - utils: Fix bounds check on cpu and end_cpu variables
  - stalld: Support denylisting of tasks in stalld
  - src/utils: use right argument for warning printf


author: Clark Williams <williams@redhat.com> - 1.11-1
changelog:
  - redhat/stalld.spec: pick up gating test version for changelog
  - utils.c: set daemon umask to restrict global write/execute (1934586)
  - hardening fixes from coverity scan (1934590)


author: Fernando Pacheco <fpacheco@redhat.com> - 1.12-1
changelog:
  - stalld.8: fix diff cruft left in manpage source
  - stalld.c: clean up handling of nr_running
  - stalld.c: remove duplicate parameter to fill_waiting_task() (1934582)
  - stalld.service: Run stalld as sched_fifo via systemd
  - stalld: Add error handling in get_cpu_idle_time() (1966259)
  - packaging: clean up Makefiles and rpm specfile (1972806)
  - stalld: Always print current function for info messages
  - stalld: Always print current function for warn messages
  - stalld: Always print current function for die messages
  - utils: change PATHMAX to 4096 (1934581)


author: Fernando Pacheco <fpacheco@redhat.com> - 1.13-1
changelog:
  - stalld: Fix log message on boost_cpu_starving_vector()
  - stalld: Add the overload control to the single-threaded mode
  - stalld: Add the adaptive mode option
  - stalld: Use the last mode set in the cmdline
  - stalld: Fallback to the adaptive mode if force_fifo is selected
  - stalld: Make single-threaded mode the default one (1920041)
  - stalld.service: Always restart stalld on exit
  - utils.c: Fail if user is not root
  - utils.c: Make the path to sched_debug path dynamic (1977663)


author: Fernando Pacheco <fpacheco@redhat.com> - 1.14.1-1
changelog:
  - stalld: Coding style cleanup
  - stalld: spaces in place of <TAB>
  - throttling: Use RT_RUNTIME_PATH in rt_throttling_is_off()
  - throttling: Check open() on turn_off_rt_throttling
  - throttling: Adjust variables in restore_rt_throttling()
  - stalld.c: utils.c: Remove complex assignments from variable declarations
  - stalld.h: Define MAX_PATH/DIR_PATH/FILE_NAME and use them
  - stalld: Adjust variables in parse_old_task_format()
  - utils.c: Use MAX_PATH for pidfile
  - stalld.c: Remove variable declaration from the middle of  the function
  - stalld: Respect -l option in single threaded mode (1983100)
  - utils: s/try_to_open_file/check_file_exists/
  - utils: use check_file_exists in setup_hr_tick()
  - utils: Check for the new sched_features path


author: Fernando Pacheco <fpacheco@redhat.com> - 1.15-1
changelog:
  - stalld: Fix incorrect open() return value checks
  - stalld: Pass errno to strerror() on sig*set() failures
  - throttling: Always null terminate sched_rt_runtime_us output
  - stalld: Remove unreachable statement in detect_task_format()
  - tests: Fix uninitialized value action.sa_mask
  - utils: Bail if malloc() returns null in parse_cpu_list()
  - stalld: Use correct format specifier for long types
    Resolves: rhbz#1990057, rhbz#1996799, rhbz#1996825


author: Fernando Pacheco <fpacheco@redhat.com> - 1.16-1
changelog:
  - stald/utils: Space, lines and voids clenaups
  - stalld: Add an option to easily set stalld as SCHED_DEADLINE
  - stalld: Comments cleanup
  - src/utils: Comments cleanup
  - src/throttling: Comments cleanup
  - src/stalld.h Comments cleanup
    Resolves: rhbz#2068549


author: Leah Leshchinsky <lleshchi@redhat.com> - 1.17.1-1
changelog:
  - stalld: Fix memory leak in print_boosted_info()
  - utils: Check if the system is in lockdown mode
  - stalld: print process comm and cpu when boosting
  Resolves: rhbz#2136559


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-6
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed The LDAP backend which is not properly parsing sudoOptions,
    resulting in selinux roles not being applied
  Resolves: rhbz#1738326


author: Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
changelog:
  - RHEL 8.2 ERRATUM
  - rebase to 1.8.28p1
  Resolves: rhbz#1733961
  - fixed man page for always_set_home
  Resolves: rhbz#1576880
  - sudo does not work with notbefore/after
  Resolves: rhbz#1679508
  - NOTBEFORE showing value of sudoNotAfter Ldap attribute
  Resolves: rhbz#1715516
  - CVE-2019-14287 sudo
  - Privilege escalation via 'Runas' specification with 'ALL' keyword
  Resolves: rhbz#1760697


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-7
changelog:
  - RHEL 8.4 ERRATUM
  - CVE-2021-3156
  Resolves: rhbz#1917734
  - CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhzb#1916434
  - CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1917038
  - updated upstream url
  Resolves: rhbz#1923825


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8
changelog:
  RHEL 8.6.0 ERRATUM
  - sudoedit does not work with selinux args
  Resolves: rhbz#2029551
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#1999751
  - [RFE] pass KRB5CCNAME to pam_authenticate environment if available
  Resolves: rhbz#1917379
  - utmp resource leak in sudo
  Resolves: rhbz#1986572


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29.8.1
changelog:
  RHEL 8.7.0.Z ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161220


author: Michal Sekletár <msekleta@redhat.com> - 11.7.3-2
changelog:
  - sysstat's buildsystem doesn't really use LDFLAGS, we have to merge CFLAGS and LDFLAGS to get binaries with full RELRO (#1624177)


author: <msekleta@redhat.com> - 11.7.3-7
changelog:
  - Don't trigger autofs mounts when running sadc (#2000910)
  - sar: Add missing %gnice CPU value for tickless CPU (#2000916)
  - sadf: Fix seg fault on empty data files (#1910841)
  - sar: Fix typo in manual page (#1877836)


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-4
changelog:
  - Added vncsession-restore script for SELinux policy migration
    Fix SELinux context for root user
    Resolves: bz#2021892


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-9
changelog:
  - xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
    Resolves: bz#2167057


author: Jan Grulich <jgrulich@redhat.com> - 1.12.0-9.3
changelog:
  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
    Resolves: bz#2180304


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c - supersedes tzdata-2021b
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.
  - Includes changes in tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
  - Rebase to tzdata-2021e - supersedes tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".
    - Palestine will fall back 2021-10-29 at 01:00, rather
      than the predicted 2021-10-30.


author: Patsy Griffin <patsy@redhat.com> - 2022a-1
changelog:
  - Rebase to tzdata-2022a
    - Palestine springs forward on 2022-03-27, not -03-26.
    - zdump -v now outputs better failure information
    - fixes for code that reads corrupted TZif data


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Lukas Vrabec <lvrabec@redhat.com> - 0.1.5-1
changelog:
  - Create mock selinux and semanage module
  - Update testing section in README
  - Add travis file for Travis CI
  - Grammar fixes in the udica.8 manpage file
  - Support port ranges (Resolves: #16)
  - Test port ranges


author: Jindrich Novy <jnovy@redhat.com> - 0.2.5-2
changelog:
  - New rebase https://github.com/containers/udica/releases/tag/v0.2.5 (#1995041)
  - Replace capability dictionary with str.lower()
  - Enable udica to generate policies with fifo class
  - Sort container inspect data before processing
  - Update templates to work properly with new cil parser
  - Related: #1934415


author: Richard Hughes <rhughes@redhat.com> - 0.99.5-1
changelog:
  - New upstream release
  - Add BatteryLevel property for devices with a finite number of power levels
  - Add support for pausing and resuming of the daemon poll
  - Do not spin in a loop when /proc/timer_stats cannot be written
  - Fix reading and writing the keyboard brightness level
  - Get a serial number for device batteries
  - Refresh devices after waking up from sleep
  - Lower initial power usage when iDevice isn't accessible


author: Richard Hughes <rhughes@redhat.com> - 0.99.6-1
changelog:
  - New upstream release
  - Detect joysticks as gaming input devices
  - Fix crash when '@' is present in the device name
  - Grab the model name from device if unavailable from battery


author: Bastien Nocera <bnocera@redhat.com> - 0.99.7-1
changelog:
  + upower-0.99.7-1
  - Update to 0.99.7
  - Add Bluetooth LE battery support
  - Fix critical action after resume from hibernate


author: Attila Lakatos <alakatos@redhat.com> - 0.7.8-4
changelog:
  - RHEL 8.3.0 ERRATUM
  - Spec file clean up
  - Rebase to 0.7.8
  Resolves: rhbz#1738590
  - Added selinux subpackage
  Resolves: rhbz#1683567
  - Added notifier subpackage
  - Installing /etc/usbguard/rules.d/
  Resolves: rhbz#1667395
  - Fixed sigwaitinfo handling
  Resolves: rhbz#1835210


author: Radovan Sroka <rsroka@redhat.com> - 0.7.8-5
changelog:
  - RHEL 8.3.0 ERRATUM
  - Use old-fasioned forking style in unit file
  Resolves: rhbz#1846885
  - Allow usbguard to read /proc/cpuinfo
  Resolves: rhbz#1847870
  - Removed notifier's Requires for usbguard-devel
  Resolves: rhbz#1667395
  - Allow usbguard to read /dev/urandom
  Resolves: rhbz#1848618


author: Radovan Sroka <rsroka@redhat.com> - 0.7.8-6
changelog:
  - RHEL 8.3.0 ERRATUM
  - Removed execstack from .spec
  - Removed AuthorizedDefault=wired from the usbguard
  Resolves: rhbz#1852539
  - Missing error message on bad configuration
  Resolves: rhbz#1857299
  - /etc/usbguard/usbguard-daemon.conf file does not contain all default options
  Resolves: rhbz#1862907


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-1
changelog:
  - Rebase to 1.0.0
  Resolves: rhbz#1887448
  - Filtering rules by attribute
  Resolves: rhbz#1873953
  - Change device policy of multiple devices using rule instead of ID
  Resolves: rhbz#1852568


author: Zoltan Fridrich <zfridric@redhat.com> - 1.0.0-8
changelog:
  - change usbguard icon injection
  - fix DSP module definition in spec file
  Resolves: rhbz#2014441
  - add execstack to spec
  - remove IPAddressDeny from usbguard service
  Resolves: rhbz#1929364
  - fix file conflict when installing usbguard on rhel
  Resolves: rhbz#1963271
  - fix IPC access control files override
  Resolves: rhbz#2004511
  - validate ACL permission existence
  Resolves: rhbz#2005020
  - decrease usbguard-notifier spam when denied connection
  Resolves: rhbz#2000000


author: Attila Lakatos <alakatos@redhat.com> - 1.0.0-8.2
changelog:
  - Fix unauthorized access via D-bus
  - Fix memory leak on D-bus connection failure
  Resolves: rhbz#2127848


author: Karel Zak <kzak@redhat.com> 2.32.1-29
changelog:
  - fix #1988955 - script command continues without stopping.
  - fix #2041498 - incorrect partition size calculation for BLKPG_* ioctls
  - fix #2011602 - logger from util-linux incorrectly handles long messages
  - fix #1916151 - [RFE] spread fstrim.timer across time
  - fix #1894192 - Update or backport setpriv --pdeathsig
  - fix #2026511 - blkid fails to complete when targeting  non-block devices


author: Karel Zak <kzak@redhat.com> 2.32.1-31
changelog:
  - improve #2026511 fix - blkid fails to complete when targeting non-block devices
  - fix #1950187 - Ambient capabilities failed to applied to non-root user


author: Karel Zak <kzak@redhat.com> 2.32.1-36
changelog:
  - fix #2060030 - Please backport patches for atari partition detection to RHEL 8
  - fix #2069187 - Internal testsuite for lscpu failed on aarch64
  - fix #2093166 - lslogins reports incorrect "Password is locked" status
  - fix #2059241 - rpm -V / --verify reports bad user/group/mtime for /run/uuidd
  - fix #2044592 - Move /var/log/lastlog ownership to systemd


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 6.0.0-1
changelog:
  - New upstream release
  - Added a patch that fixes _FORTIFY_SOURCE=2 on copr/el6
  - Added a patch fixing compilation on epel6
  - Fresh checkout of pkg-varnish-cache
  - Updated find-requires sed fix to update variant and moved it to prep
  - Removed -libs subpackage
  - varnish_reload_vcl changed name to varnishreload, as in upstream
  - varnish.params is gone. To override startup configuration,
    use /etc/systemd/system/varnish.service
  - Dropped patch and sed fixes for find-provides, as it is fixed upstream
  - Dropped patch for test vsv00002, as it is fixed upstream
  - Droppet patch for python3, as it is included upstream
  - Dropped buildreq on groff, as tarball includes prebuilt manpages
  - Dropped systemv to systemd helpers
  - Updated project url
  - Use prebuilt html files for docs subpackage
  - Dropped unnecessary explicit require of initscripts, closes #1592398


author: Lubos Uhliarik <luhliari@redhat.com> - 6.0.6-2
changelog:
  - new version 6.0.6
  - Resolves: #1795673 - RFE: rebase varnish:6 to latest 6.0.x LTS
  - Resolves: #1790907 - CVE-2019-20637 varnish: not clearing pointer between two
    client requests leads to information disclosure
  - Resolves: #1763958 - CVE-2019-15892 varnish:6/varnish: denial of service 
    handling certain crafted HTTP/1 requests


author: Luboš Uhliarik <luhliari@redhat.com> - 6.0.8-1
changelog:
  - new version 6.0.8
  - Resolves: #1982862 - CVE-2021-36740 varnish:6/varnish: HTTP/2 request
    smuggling attack via a large Content-Length header for a POST request


author: Luboš Uhliarik <luhliari@redhat.com> - 6.0.8-2
changelog:
  - Resolves: #2047650 - CVE-2022-23959 varnish:6/varnish: Varnish HTTP/1 Request
    Smuggling Vulnerability


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.36.1-1
changelog:
  - Update to 2.36.1
    Related: #2061994
  - Resolves: #2075492
  - Resolves: #2075494
  - Resolves: #2075496


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-13
changelog:
  - Added -DDFLTCC parameter to configure to enable 
  - Z hardware-accelerated deflate for s390x architectures (#1659433)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-16
changelog:
  - Permit a deflateParams() parameter change
  - Another fix for Z hardware-accelerated deflate for s390x architectures
  - according to previous change by upstream


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - Fixed DFLTCC compression level switching issues (#1875492)
  - Enabled HW compression for compression levels 1 through 6 (#1847438)
  - Fixed inflateSyncPoint() bad return value on z15 (#1888930)


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.11-19
changelog:
  - Apply IBM patch for compressBound() function
  - Source from https://github.com/madler/zlib/issues/410#issuecomment-947212824
  - Resolves: #2056900


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11-20
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


